headers derived

{
  "input": {
    "body": {
      "url": "https://github.com"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "csp": {
        "value": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com ...",
        "present": true,
        "policies": 1,
        "directives": [
          "base-uri",
          "child-src",
          "connect-src",
          "default-src",
          "font-src",
          "form-action",
          "frame-ancestors",
          "frame-src",
          "img-src",
          "manifest-src",
          "media-src",
          "script-src",
          "style-src",
          "upgrade-insecure-requests",
          "worker-src"
        ],
        "report_only": false,
        "unsafe_eval": false,
        "unsafe_inline": false,
        "frame_ancestors": "'none'",
        "wildcard_sources": false,
        "missing_directives": [],
        "scripts_restricted": true,
        "object_src_restricted": true
      },
      "url": "https://github.com",
      "hsts": {
        "valid": true,
        "value": "max-age=31536000; includeSubdomains; preload",
        "max_age": 31536000,
        "preload": true,
        "present": true,
        "preload_eligible": true,
        "include_subdomains": true
      },
      "note": "one response's headers only; pages, APIs and error responses of the same site can differ",
      "grade": "A",
      "https": true,
      "score": 90,
      "status": 200,
      "cookies": {
        "count": 3,
        "items": [
          {
            "name": "_gh_sess",
            "secure": true,
            "httponly": true,
            "samesite": "Lax",
            "host_prefix": false,
            "secure_prefix": false
          },
          {
            "name": "_octo",
            "secure": true,
            "httponly": false,
            "samesite": "Lax",
            "host_prefix": false,
            "secure_prefix": false
          }
        ],
        "truncated": false
      },
      "final_url": "https://github.com",
      "redirects": [],
      "deductions": [
        {
          "code": "permissions_policy_missing",
          "points": 5,
          "reason": "no Permissions-Policy header"
        },
        {
          "code": "cookie_not_httponly",
          "points": 5,
          "reason": "1 cookie(s) without HttpOnly (fine only if scripts must read them)"
        }
      ],
      "disclosure": {
        "server": "github.com",
        "x_powered_by": null,
        "x_aspnet_version": null
      },
      "cross_origin": {
        "opener_policy": null,
        "embedder_policy": null,
        "resource_policy": null
      },
      "referrer_policy": {
        "note": null,
        "value": "origin-when-cross-origin, strict-origin-when-cross-origin",
        "effective": "strict-origin-when-cross-origin"
      },
      "x_frame_options": {
        "valid": true,
        "value": "DENY"
      },
      "untrusted_content": true,
      "upgraded_to_https": false,
      "permissions_policy": {
        "value": null,
        "present": false
      },
      "x_content_type_options": {
        "valid": true,
        "value": "nosniff"
      }
    }
  }
}