Response Headers Test Hub

This hub links to three pages that deliberately emit misconfigured HTTP response headers, used by SiteScan analyzer 030_response_headers for validation.

Sub-tests

• Insecure cookies — sets Set-Cookie without Secure/HttpOnly/SameSite flags. Triggers E01, W01, W02.
• ETag inode leak — emits an ETag in Apache inode-leak format (three hex segments). Triggers W08.
• Slow TTFB — sleeps 1.7s before responding. Triggers I02 top_slow list.

Expected 030 behavior on these pages

After crawling, the response_headers.json file should show these URLs with the specific headers set, and analyzer 030 should emit the corresponding findings. The hub page itself should be clean (no patological headers).