From 06eced0951456b39e1e01b34ca01eca58fa575aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Mon, 27 Jul 2026 15:17:19 -0300
Subject: [PATCH] test(httpd): verify security response headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
---
 xCAT-test/autotest/testcase/httpd/cases0 | 30 ++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 xCAT-test/autotest/testcase/httpd/cases0

diff --git a/xCAT-test/autotest/testcase/httpd/cases0 b/xCAT-test/autotest/testcase/httpd/cases0
new file mode 100644
index 000000000..27d0c3ee7
--- /dev/null
+++ b/xCAT-test/autotest/testcase/httpd/cases0
@@ -0,0 +1,30 @@
+start:httpd_security_headers_install
+description:verify xcat.conf sets the security response headers on /install
+label:mn_only,ci_test,httpd
+cmd:curl -sSI --max-time 15 http://localhost/install/ 2>&1
+check:rc==0
+check:output=~X-Frame-Options:\s*SAMEORIGIN
+check:output=~X-Content-Type-Options:\s*nosniff
+check:output=~Content-Security-Policy:\s*script-src
+check:output=~X-Permitted-Cross-Domain-Policies:\s*none
+end
+
+start:httpd_security_headers_tftpboot
+description:verify xcat.conf sets the security response headers on /tftpboot
+label:mn_only,ci_test,httpd
+cmd:curl -sSI --max-time 15 http://localhost/tftpboot/ 2>&1
+check:rc==0
+check:output=~X-Frame-Options:\s*SAMEORIGIN
+check:output=~X-Content-Type-Options:\s*nosniff
+check:output=~Content-Security-Policy:\s*script-src
+check:output=~X-Permitted-Cross-Domain-Policies:\s*none
+end
+
+start:httpd_server_banner_masked
+description:verify ServerTokens Prod masks the Apache version in the Server header
+label:mn_only,ci_test,httpd
+cmd:curl -sSI --max-time 15 http://localhost/install/ 2>&1
+check:rc==0
+check:output=~Server:\s*Apache
+check:output!~Apache/[0-9]
+end