Security Report Summary
C
Site: https://ciam.credicorpcapitallab.com/labcapitalb2c.onmicrosoft.com/b2c_1a_transaccional_signin/oauth2/v2.0/authorize?client_id=f6241a6c-eae6-4a68-bdc7-6f2d7313316a&scope=openid%20f6241a6c-eae6-4a68-bdc7-6f2d7313316a%20profile%20offline_access&redirect_uri=https%3a%2f%2fwww.credicorpcapitaldigital.com%2ftransaccionales&client-request-id=b537cd59-6733-4167-a53c-04ab26fd52e3&response_mode=fragment&response_type=code&x-client-sku=msal.js.browser&x-client-ver=2.30.0&client_info=1&code_challenge=7wzbjcmdubgihdd7b73cbigz3hm9ms1p5ihrnqx4_4w&code_challenge_method=s256&nonce=5b159f45-0ba5-4345-9adc-4830eed1a0e9&state=eyjpzci6ijq3yzdlnmu3lwm1mdetndmyyy1iotkxltfinda1ogy3nzm5ncisim1ldgeionsiaw50zxjhy3rpb25uexblijoicmvkaxjly3qifx0%3d
IP Address: 2620:1ec:46::69
Report Time: 02 May 2024 12:45:33 UTC
Headers:
  • X-Frame-Options
  • Strict-Transport-Security
  • X-Content-Type-Options
  • Content-Security-Policy
  • Referrer-Policy
  • Permissions-Policy
Advanced:
Not bad… Maybe you should perform a deeper security analysis of your website and APIs:
Missing Headers
Content-Security-PolicyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.
Referrer-PolicyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Raw Headers
HTTP/2200
dateThu, 02 May 2024 12:45:33 GMT
content-typetext/html; charset=utf-8
content-length216080
cache-controlno-store, must-revalidate, no-cache
expires-1
x-ms-gateway-requestidaa4843c0-7266-4b24-a9a4-53ec30adeb6b
x-ua-compatibleIE=edge
x-request-id35cb4cbd-b04d-47e1-8569-1364e0f01b36
x-build1.1.144.0
x-frame-optionsDENY
publicOPTIONS,TRACE,GET,HEAD,POST
strict-transport-securitymax-age=31536000; includeSubDomains
x-content-type-optionsnosniff
x-xss-protection1; mode=block
set-cookiex-ms-cpim-sso:labcapitalb2c.onmicrosoft.com_0=m1.AcUhHM5IaZimUzK5.h9KPk664wq2d2KGyhjt+yQ==.0.P+f2uKXSBflWK/BDuHEpISYkz36mQ6uHMQsRoOn09VBejCDxxvj3spGhpvvfjnW5eMWqHUc2b2xQ20n4YMIifL3NE38/XN9a0z8SJtAoJmn8sHCN0X3a2cCgf5YoQ9u0xVgUM4bVNfvqQDc71UW465VtTzTJTp69oWAoVqhohu0lhVtPktELymHzwCrF5PLYLk840f+NYn4hnOxBSSfzs/467mPcn1Yrkl1sqN2PHXx1t6hWXp/r3C41SWoZ9p7Va9Qd7yG0t/YPu2AeGkKkFsaLQg1XX8ytjYWOlIgbxO+ds4pHHiSgXhgW1jIsV5K+f7U1hLDIdzITAA==; domain=ciam.credicorpcapitallab.com; path=/; SameSite=None; secure; HttpOnly
set-cookiex-ms-cpim-csrf=UkVTcmlPS3NQbHBNTmt5Y2JWclhKQUpwMWwrV3RvNmFudWRqUVBpZW9GUHZSTFlkcmQxeHMvUWR0SmFoMld0NzJnL0ZncC9JWHNJNTQ0V0VxRGErZ0E9PTsyMDI0LTA1LTAyVDEyOjQ1OjMzLjY4NjM1MDFaO3c0V21LbUt1VUVBK0c4QjdCbmdLZHc9PTt7Ik9yY2hlc3RyYXRpb25TdGVwIjoyfQ==; domain=ciam.credicorpcapitallab.com; path=/; SameSite=None; secure; HttpOnly
set-cookiex-ms-cpim-cache|vuzlnu2w4uefarnk4pabng_0=m1.oGiUPNLvNXPDDhVU.6zxKsmFzWbm6DmlNvOp4LA==.0.c3mqVSoxbMCHPXgFbOqF8YJHnUJSxjcXVPh77IKx4+jvHEPM8s50k20vjVUCsRV+3npEgN2I7LrLzDmHn1GPA8gdqtry4v06Gmqd4A0IR4QIZeH/YUB0pbSuk4aI6mRqygvdFCHtW/3DHTHnpGYMh1nCR9o5lClpieXfCAh1zqlSIlHQ3+GG0atjkg3JvvdY6vl6LES75SwrtaXAeNsKFmoDXHItvg7vMRYqGixYFrzgo9WqkqL0Ga3dITym1xOlAjRxhCtlpbfAZi+ySZZYJUSA3PpULW2Jlxp2k03IZWOljZT0tIwKujD3hOrhiElHonJmnqqhQ2vaqIMwB8MNNwt8pweJOy7TUyf72r45Tem6SOyB/vsWBzpImk6E9wZTBEHcLsOH/ZGMnhF7bo+M5zy2TFkcyymR8ooeoh7FbukBToaU5veL5Or/+Npv3PDSx1Om3YGP+K9AafzXYz+sKD6binAZou7bC68KdmI3czLFZw6NVuu+ErbNORyRL/ZSqDTuMJZTC2FDVC0QxJ3MlkDB5lSG805AcM7AbqwVMfBwdcrmBoUrhS6ow0Ke+GJSaUwr++CuWDin1OK1+6cg3KbgNxwzUagcOEYhzZy5tbA0Glm5o1DPOyZO8CgIQrVHqQ6QubLpWY1I/w0a2Ef/mozpHMwKw8Ru84FvDomY8Rfvkz0u1BSkvR4wW0WyIG/oLjwwsiA5mcpu0BuAd6R19a0KIqoIodf6JG0ei7338rRuD36iswby850m4smwaBGRBB/rP2n+9ojxZ7ZQiwbiSrs77tvzHQEAsy+TnkzSdtnjGYboTiBTxt58agFYJTHd0/VcpnH665Sf1v75JICW+N0ENJOWfblQLOB+1PJBh3fI021Yp4584ooLSrEuaNB/dx5uCENKAo7HzKoSjApEuvOQKrp4LrpsfpfYbyClOZ4jh/PVy0P7aRFAHV8zOvWxgUHQZTkqMG3XPRgKorec+NWwYQepusTy/Zm0AWF9+ohVyOGhl824PilMmNf0xbPBgVozKVvAAfdCaPUDzz54oAKSg2GbWic4JWlMk7gS9wN3CMr4; domain=ciam.credicorpcapitallab.com; path=/; SameSite=None; secure; HttpOnly
set-cookiex-ms-cpim-trans=eyJUX0RJQyI6W3siSSI6IjM1Y2I0Y2JkLWIwNGQtNDdlMS04NTY5LTEzNjRlMGYwMWIzNiIsIlQiOiJsYWJjYXBpdGFsYjJjLm9ubWljcm9zb2Z0LmNvbSIsIlAiOiJiMmNfMWFfdHJhbnNhY2Npb25hbF9zaWduaW4iLCJDIjoiZjYyNDFhNmMtZWFlNi00YTY4LWJkYzctNmYyZDczMTMzMTZhIiwiUyI6MSwiTSI6e30sIkQiOjAsIkUiOiIifV0sIkNfSUQiOiIzNWNiNGNiZC1iMDRkLTQ3ZTEtODU2OS0xMzY0ZTBmMDFiMzYifQ==; domain=ciam.credicorpcapitallab.com; path=/; SameSite=None; secure; HttpOnly
allowOPTIONS
allowTRACE
allowGET
allowHEAD
allowPOST
x-azure-ref20240502T124533Z-r1f495864dfrmdwg35gguyhuyn0000000mu00000000029pt
x-cacheCONFIG_NOCACHE
accept-rangesbytes
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
x-frame-optionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
x-xss-protectionX-XSS-Protection sets the configuration for the XSS Auditor built into older browsers. The recommended value was "X-XSS-Protection: 1; mode=block" but you should now look at Content Security Policy instead.
set-cookieThere is no Cookie Prefix on this cookie. This is not a SameSite Cookie.