33 lines
2.0 KiB
Bash
33 lines
2.0 KiB
Bash
#!/usr/bin/env bash
|
|
# verify_coolcoth_deploy.sh
|
|
# 部署到 coolcoth.com 后自动复核安全响应头是否生效。
|
|
# 用法： bash verify_coolcoth_deploy.sh
|
|
set -u
|
|
HOST="coolcoth.com"
|
|
pass=0; fail=0
|
|
check(){ # $1=名称 $2=是否通过(1/0) $3=实际值
|
|
if [ "$2" = "1" ]; then echo "[PASS] $1"; pass=$((pass+1));
|
|
else echo "[FAIL] $1 -> 实际: $3"; fail=$((fail+1)); fi
|
|
}
|
|
|
|
hdr=$(curl -s -D - -o /dev/null -m 15 "https://$HOST/")
|
|
hsts=$(printf '%s' "$hdr" | tr -d '\r' | awk -F': ' 'tolower($1)=="strict-transport-security"{print $2}')
|
|
ref=$(printf '%s' "$hdr" | tr -d '\r' | awk -F': ' 'tolower($1)=="referrer-policy"{print $2}')
|
|
perm=$(printf '%s' "$hdr" | tr -d '\r' | awk -F': ' 'tolower($1)=="permissions-policy"{print $2}')
|
|
xct=$(printf '%s' "$hdr" | tr -d '\r' | awk -F': ' 'tolower($1)=="x-content-type-options"{print $2}')
|
|
|
|
echo "=== coolcoth.com 部署复核 @ $(date '+%F %T') ==="
|
|
echo "$hsts" | grep -q "max-age=63072000" && check "HSTS max-age=63072000" 1 || check "HSTS max-age" 0 "$hsts"
|
|
echo "$hsts" | grep -q "includeSubDomains" && check "HSTS includeSubDomains" 1 || check "HSTS includeSubDomains" 0 "$hsts"
|
|
echo "$hsts" | grep -q "preload" && check "HSTS preload" 1 || check "HSTS preload" 0 "$hsts"
|
|
echo "$ref" | grep -qi "strict-origin-when-cross-origin" && check "Referrer-Policy=strict-origin-when-cross-origin" 1 || check "Referrer-Policy" 0 "$ref"
|
|
echo "$perm" | grep -q "payment=()" && check "Permissions-Policy 含 payment=()" 1 || check "Permissions-Policy payment" 0 "$perm"
|
|
echo "$xct" | grep -qi "nosniff" && check "X-Content-Type-Options=nosniff" 1 || check "X-Content-Type-Options" 0 "$xct"
|
|
|
|
echo "----"
|
|
echo "PASS=$pass FAIL=$fail"
|
|
[ "$fail" = "0" ] && echo ">> 部署成功 ✅（所有安全头已生效）" || echo ">> 仍有未生效项 ❌（部署/清OPcache未完成）"
|
|
|
|
echo
|
|
echo "【登录 429 限流需人工确认】验证码为算术图，外部自动化无法解；请按手册第5步用有效 csrf+captcha 压测 5~6 次错密，确认返回 429。"
|