security-headers.php

<?php
// ============ Security Headers Inspector (live) ============
// Membaca KONFIGURASI proteksi framing yang benar-benar dipakai endpoint
// (single source of truth: includes/security.php :: frame_policy_map),
// lalu mengonfirmasi header yang terkirim pada request saat ini via
// headers_list(). Ini bukan hardcode hasil — tabel = sumber header.
require __DIR__ . '/includes/security.php';
require_login();

$paths = array_keys(frame_policy_map());
?>
<!DOCTYPE html>
<html lang="id">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Security Headers Inspector</title>
<link rel="stylesheet" href="/assets/style.css">
</head>
<body>
<nav class="navbar">
  <span class="brand">Account Portal</span>
  <span class="nav-links">
    <a href="/dashboard.php">Dashboard</a>
    <a href="/security-lab.php">Security Lab</a>
    <a href="/security-headers.php">Headers Inspector</a>
    <a href="/logout.php">Logout</a>
  </span>
</nav>
<main class="container">
<h1>Security Headers Inspector</h1>

<div class="card">
  <h2>Anti-Framing Headers (per endpoint)</h2>
  <table>
    <tr>
      <th>Endpoint</th>
      <th>X-Frame-Options</th>
      <th>CSP frame-ancestors</th>
      <th>Clickjacking Protection</th>
    </tr>
    <?php foreach ($paths as $path): ?>
      <?php [$xfo, $csp, $protected] = frame_policy_for($path); ?>
      <tr>
        <td><span class="mono"><?= e($path) ?></span></td>
        <td>
          <?php if ($xfo !== null): ?>
            <span class="badge safe">✅ <?= e($xfo) ?></span>
          <?php else: ?>
            <span class="badge vuln">❌ Missing</span>
          <?php endif; ?>
        </td>
        <td>
          <?php if ($csp !== null): ?>
            <span class="badge safe">✅ <?= e($csp) ?></span>
          <?php else: ?>
            <span class="badge vuln">❌ Missing</span>
          <?php endif; ?>
        </td>
        <td>
          <?php if ($protected): ?>
            <span class="badge safe">✅ Protected</span>
          <?php else: ?>
            <span class="badge vuln">❌ Vulnerable</span>
          <?php endif; ?>
        </td>
      </tr>
    <?php endforeach; ?>
  </table>
  <p class="muted small">
    Inspector membaca <code>frame_policy_map()</code> — tabel yang sama yang dipakai
    endpoint untuk mengirim header. Verifikasi wire-level bisa lewat:
    <code>curl -I <?= e(app_base()) ?>/account/settings.php</code>
  </p>
</div>

<div class="card">
  <h2>Header terkirim pada request ini (headers_list)</h2>
  <div class="mono">
    <?php foreach (live_frame_headers() as $h): ?>
      <?= e($h) ?><br>
    <?php endforeach; ?>
  </div>
  <p class="muted small">Daftar di atas adalah header yang benar-benar dikirim oleh
     PHP pada respons /security-headers.php saat ini.</p>
</div>

<div class="card">
  <h2>Cara verifikasi manual (wire)</h2>
  <ol>
    <li>Buka <span class="mono">/account/settings.php</span> di browser → DevTools &gt; Network → respon header: tidak ada <code>X-Frame-Options</code> / <code>CSP frame-ancestors</code>.</li>
    <li>Buka <span class="mono">/account/settings-secure.php</span> → header terlihat:
        <code>X-Frame-Options: DENY</code> dan <code>Content-Security-Policy: frame-ancestors 'none';</code>.</li>
    <li>Atau via cURL:
        <code>curl -I <?= e(app_base()) ?>/account/settings.php</code> — bandingkan dengan
        <code>curl -I <?= e(app_base()) ?>/account/settings-secure.php</code>.</li>
  </ol>
</div>
</main>
<footer class="footer muted small">
  Account Portal — Clickjacking Lab · target lokal saja (127.0.0.1)
</footer>
</body>
</html>