Detecting Uncommon Headers in an API using Burp Bambda Filters

find_uncommon_headers.java

// Source: https://danaepp.com/detecting-uncommon-headers

String[] standardHeaders = {
	"accept-patch",
	"accept-ranges",
	"access-control-allow-credentials",
	"access-control-allow-headers",
	"access-control-allow-methods",
	"access-control-allow-origin",
	"access-control-expose-headers",
	"access-control-max-age",
	"age",
	"allow",
	"alt-svc",
	"cache-control",
	"clear-site-data",
	"connection",
	"content-disposition",
	"content-encoding",
	"content-language",
	"content-length",
	"content-location",
	"content-range",
	"content-security-policy",
	"content-transfer-encoding",
	"content-type",
	"cross-origin-embedder-policy",
	"cross-origin-opener-policy",
	"cross-origin-resource-policy",
	"date",
	"delta-base",
	"etag",
	"expect-ct",
	"expires",
	"feature-policy",
	"host",
	"im",
	"keep-alive",
	"last-modified",
	"link",
	"location",
	"pragma",
	"proxy-authenticate",
	"public-key-pins",
	"referrer-policy",
	"retry-after",
	"server",
	"set-cookie",
	"strict-transport-security",
	"tk",
	"trailer",
	"transfer-encoding",
	"upgrade",
	"vary",
	"via",
	"warning",
	"www-authenticate",
	"x-content-type-options",
	"x-frame-options",
	"x-permitted-cross-domain-policies",
	"x-xss-protection"
};

List headersList = Arrays.asList(standardHeaders);

var response = requestResponse.response();
if (response != null) {

	var headers = response.headers();

	List unexpectedHeaders = new ArrayList();

	for(var header : headers) {
    	var headerName = header.name().toLowerCase();
		if(!headersList.contains(headerName) && !unexpectedHeaders.contains(headerName)) {
			unexpectedHeaders.add(headerName);
    	}
	}

	if( unexpectedHeaders.size() > 0 ) {
		requestResponse.annotations().setHighlightColor( HighlightColor.GRAY );  
		requestResponse.annotations().setNotes(
    		"Non-standard Headers: " + String.join( ", ", unexpectedHeaders )
    	);
	}
	else {
    	requestResponse.annotations().setHighlightColor( HighlightColor.NONE );
    	requestResponse.annotations().setNotes("");
	} 
}

return true;