[casoon]

Package 2, part 3: security, transport and DNS on the collection contract (#799).

#774 Security header fetch

• security.fetch records:

  • the source: http_probe, a request outside the browser, so it is distinguishable from the browser's document response;
  • method and status;
  • requested and final URL;
  • the status of a rejected HEAD.

• HEAD that fails or is rejected (405, 403, …) falls back to GET.

• Each of these is a failed collection (security.headers), not an empty header set, so it produces no findings and no score:

  • timeout (http_timeout);
  • refused connection (http_connect_failed);
  • an error status, e.g. a WAF 403 page (http_error_status).

• Source maps record their own collection. Assets that did not answer make the check partial, and an unreachable page makes it failed instead of "no leaks".

• The certificate state records its own collection:

  • measured;
  • certificate_state_unavailable;
  • not applicable without TLS;
  • unsupported when the listener failed.

  It replaces the old certificate_listener subcheck.

• Counter-cases run against a local server: refused connection, timeout, HEAD 405 with GET fallback, 403, and a redirect with its final URL.

#775 Transport of the audited document

• HTTPS comes from the probe's final URL. SEO already reads it from the loaded document.
• security.document_match (scoring) compares the probe's final scheme and host with the browser's final URL. On a mismatch the headers describe another document, so security is partial and does not count toward the overall score.
• Redirect hygiene stays separate, in page health (http_to_https, redirect chain).

#776 DNS answers

• Every lookup returns one of three outcomes:

  • found;
  • absent (NXDOMAIN/NODATA);
  • unknown (dns_timeout, dns_lookup_failed).

  Unknown produces no finding, reads "unknown" in the PDF, and records a failed collection for that check (network_dns.caa, dnskey, mx, spf).

• CAA and DNSKEY walk up the parent domains, following RFC 8659 tree climbing; DNSKEY sits at the zone apex. The DNSSEC scope is documented: a published DNSKEY, no chain validation.

• MX unknown makes SPF unknown, not "no mail".

• The resolver is a trait. A scripted resolver tests NODATA, NXDOMAIN, SERVFAIL, timeout and delegation.

• Only complete answers are cached per host.

Validation (local, all green)

• fmt passes, and clippy -D warnings is clean with all features and with no default features.
• cargo test --all-features passes, including the security detection corpus.
• The ignored suites CI runs all pass: integration_test 45/45, detection_corpus_test, schema_rules_detection_corpus_test, vulnerable_libs_detection_corpus_test, easy_language_detection_test, help_mechanisms_detection_test, score_calibration_test.
• reference_sites_test shows no deviation.