setcookie ( string $key [, string $value = "" [, int $expires = 0 [, string $path = "" [, string $domain = "" [, bool $secure = FALSE [, bool $httponly = FALSE ]]]]]] ) : bool

response.setHeader('Set-Cookie', 'key=value; secure; HttpOnly; SameSite=Strict');

self.set_secure_cookie('key', value, secure=True, httponly=True)

cookies["key"] = { :value => "value", :secure => true, :http_only => true, :same_site =>  }

curl -I -L --url <target domain or IP>

➜ curl -I -L --url example.fr/espace-client
HTTP/1.1 301 Moved Permanently
Location: https://www.example.fr/
Content-Length: 0
Connection: close
Date: Thu, 04 Jul 2019 13:18:30 GMT

HTTP/2 200
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15724800; includeSubDomains
cache-control: max-age=3600, public
link: <http://www.example.fr/>; rel="shortlink", <http://www.example.fr/>; rel="canonical"
link: </node/1>; rel="revision"
x-ua-compatible: IE=edge
content-language: fr
x-content-type-options: nosniff
x-frame-options: DENY
expires: Sun, 19 Nov 1978 05:00:00 GMT
last-modified: Thu, 04 Jul 2019 12:29:39 GMT
etag: W/"1562243379"
x-drupal-cache: HIT
x-xss-protection: 1; mode=block
access-control-allow-origin: *
content-security-policy: upgrade-insecure-requests
access-control-allow-methods: POST, GET, DELETE, PUT
access-control-max-age: 1000
access-control-allow-headers: Content-Type, origin, accept
referrer-policy: no-referrer
date: Thu, 04 Jul 2019 13:18:30 GMT
vary: cookie

nmap -p 443,80 --script http-security-headers <target IP or Domain>

➜ nmap -p 443,80 --script http-security-headers example.fr
Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-04 15:19 CEST
Nmap scan report for example.fr (92.223.124.199)
Host is up (0.012s latency).

PORT    STATE SERVICE
80/tcp  open  http
| http-security-headers:
|   Strict_Transport_Security:
|     Header: Strict-Transport-Security: max-age=15724800; includeSubDomains
|   X_Frame_Options:
|     Header: X-Frame-Options: SAMEORIGIN, DENY
|     Description: The browser must not display this content in any frame.
|   X_XSS_Protection:
|     Header: X-XSS-Protection: 1; mode=block
|     Description: The browser will prevent the rendering of the page when XSS is detected.
|   X_Content_Type_Options:
|     Header: X-Content-Type-Options: nosniff
|     Description: Will prevent the browser from MIME-sniffing a response away from the declared content-type.
|   Content_Security_Policy:
|     Header: Content-Security-Policy: upgrade-insecure-requests
|     Description: Instructs user agent to download insecure resources using HTTPS.
|   Cache_Control:
|     Header: Cache-Control: max-age=3600, public
|   Expires:
|_    Header: Expires: Sun, 19 Nov 1978 05:00:00 GMT
443/tcp open  https
| http-security-headers:
|   Strict_Transport_Security:
|     Header: Strict-Transport-Security: max-age=15724800; includeSubDomains
|   X_Frame_Options:
|     Header: X-Frame-Options: SAMEORIGIN, DENY
|     Description: The browser must not display this content in any frame.
|   X_XSS_Protection:
|     Header: X-XSS-Protection: 1; mode=block
|     Description: The browser will prevent the rendering of the page when XSS is detected.
|   X_Content_Type_Options:
|     Header: X-Content-Type-Options: nosniff
|     Description: Will prevent the browser from MIME-sniffing a response away from the declared content-type.
|   Content_Security_Policy:
|     Header: Content-Security-Policy: upgrade-insecure-requests
|     Description: Instructs user agent to download insecure resources using HTTPS.
|   Cache_Control:
|     Header: Cache-Control: max-age=3600, public
|   Expires:
|_    Header: Expires: Sun, 19 Nov 1978 05:00:00 GMT

Nmap done: 1 IP address (1 host up) scanned in 0.88 seconds