HTTP Headers Analysis for https://qa.testcatalog.org

Detected Technologies from Headers

See all in URL Inspect 1

AWS CloudFront

HTTP Security Headers

Status

Strict-Transport-Security

Missing

Not configured

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Add Strict-Transport-Security header with max-age of at least 1 year
• Add Content-Security-Policy header to prevent XSS attacks
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

connection: close
transfer-encoding: chunked

Caching Headers

Cache-Control

Caching

max-age=0, private, must-revalidate

Etag

Caching

W/"dc21d1ef03fce7d6fad1b2af0da0452f"

cache-control: max-age=0, private, must-revalidate
etag: W/"dc21d1ef03fce7d6fad1b2af0da0452f"

Content Headers

Content-Type

Content

text/html; charset=utf-8

content-type: text/html; charset=utf-8

Server Headers

X-Runtime

Server

0.029251

x-runtime: 0.029251

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: subdomain=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkluRmhJZz09IiwiZXhwIjpudWxsLCJwdXIiOiJjb29raWUuc3ViZG9tYWluIn19--74ce7c9b5d57976a18268dd10d23ceb3501be75a; domain=testcatalog.org; path=/; expires=Tue, 07 Aug 2046 23:03:30 GMT; secure; HttpOnly; SameSite=Lax
_WebJC_jlqWI3QBHcExqZaaCwriOXr8VjXvvhGR=f9c70d586b803a374d1a30438e1d3faa; domain=.testcatalog.org; path=/; secure; HttpOnly; SameSite=Lax
BIGipServermayocliniclabs_jtc_qa_pool=3506483466.42255.0000; path=/; Httponly; Secure
TS0177879e=01510a900ac1bc560d458b67b74963ab74c7c4e61802681dd8ed7c61d70aeb8a94327f63e20ee97b760223a554e6474d5ef7c698bac6ea8cb8ee90d73ca6fee0e0f42c51d4; Path=/; Secure; HttpOnly
TS015453c6=01510a900ab0f179f8da6666e57773025dca550f2a02681dd8ed7c61d70aeb8a94327f63e25ce4e2ad594408affd847ab746d2c066876eb36ddc21ff5601d7e2f58bba1c35; path=/; domain=testcatalog.org; HttpOnly; Secure
TS0142e307=01510a900a6d91fa36e243a39b26d143457039bb2d02681dd8ed7c61d70aeb8a94327f63e2d5e3145e9d1efaf4e955edf45124b3ee55e250b8a7eb6c2db10d511cab7a2435; path=/; domain=.testcatalog.org; HttpOnly; Secure

Other Headers

Date

Other

Fri, 07 Aug 2026 23:03:30 GMT

Link

Other

URL

https://d39ekovleo016v.cloudfront.net/assets/application-a8f1a6b9057f08f4ebf3354bcbc61158d78102f667f5d63e74fd98305b52e5cd.js

rel=preload as=script nopush

URL

https://d39ekovleo016v.cloudfront.net/assets/mobile_responsive-506f4b1a6cd9ce953d9d4bdda6232a4deea58855c44aeca6c6ab32976bba3db5.js

rel=preload as=script nopush

Status

Other

200 OK

X-Permitted-Cross-Domain-Policies

Other

none

X-Request-Id

Other

c5d36ccc-3d29-4c15-86eb-54d8fd8ef40c

date: Fri, 07 Aug 2026 23:03:30 GMT
link: <https://d39ekovleo016v.cloudfront.net/assets/application-a8f1a6b9057f08f4ebf3354bcbc61158d78102f667f5d63e74fd98305b52e5cd.js>; rel=preload; as=script; nopush,<https://d39ekovleo016v.cloudfront.net/assets/mobile_responsive-506f4b1a6cd9ce953d9d4bdda6232a4deea58855c44aeca6c6ab32976bba3db5.js>; rel=preload; as=script; nopush
status: 200 OK
x-permitted-cross-domain-policies: none
x-request-id: c5d36ccc-3d29-4c15-86eb-54d8fd8ef40c

Recommendations

Enable compression (gzip/brotli) to improve performance