Important
Dear Mozilla Observatory Users,
This code repository is now deprecated. There is a Node/Javascript based replacement available, that has updated scoring and backs the HTTP Observatory service on MDN.
- No Further Updates: We will no longer be providing updates, bug fixes, or new features for this repository.
- Limited Support: Official support will be discontinued.
- Archival: The repository will be archived soon, making it read-only.
🔍 Alternatives and Recommendations
We recommend transitioning to HTTP Observatory, maintained by MDN.
📦 Migration Guide
To assist you in transitioning, we have prepared a Migration Guide that covers steps to migrate your existing setup to the alternative.
The Mozilla HTTP Observatory is a set of tools to analyze your website and inform you if you are utilizing the many available methods to secure it.
It is split into three projects:
- http-observatory - scanner/grader
- observatory-cli - command line interface
- http-observatory-website - web interface
Sites can be scanned using:
- observatory.mozilla.org - the online interface
- observatory-cli - the official node.js command line interface
- java-http-observatory-api - a third party java library and command line interface
- Python 3.11
- Git
- pip
These instructions assume that you have a working Python3.11 development environment with pip installed and capable of building requirements, which may require installing an additional python OS package (-dev, -devel).
# Clone the code $ git clone https://github.com/mozilla/http-observatory.git $ cd http-observatory # Install poetry $ pip install poetry # Install the project dependencies and scripts $ poetry install # Activate the virtual environment $ poetry shell # Install the pre-commit hooks $ pre-commit install # copy and edit the config file $ cp httpobs/conf/httpobs.conf ~/.httpobs.conf $ nano ~/.httpobs.conf # start the dev server $ httpobs-servernosetests httpobs/tests --with-coverage --cover-package=httpobs# Install the HTTP Observatory $ git clone https://github.com/mozilla/http-observatory.git $ cd http-observatory $ pip install poetry $ poetry install>>> from httpobs.scanner import scan >>> scan('observatory.mozilla.org') # a scan with default options >>> scan('observatory.mozilla.org', # all the custom options http_port=8080, # http server runs on port 8080 https_port=8443, # https server runs on port 8443 path='/foo/bar', # don't scan /, instead scan /foo/bar cookies={'foo': 'bar'}, # set the "foo" cookie to "bar" headers={'X-Foo': 'bar'}, # send an X-Foo: bar HTTP header verify=False) # treat self-signed certs as valid for tests like HSTS$ poetry shell $ httpobs-local-scan --http-port 8080 --https-port 8443 --path '/foo/bar' \ --cookies '{"foo": "bar"}' --headers '{"X-Foo": "bar"}' --no-verify mozilla.org- April King
- Mozilla Public License Version 2.0