Submitted URL: http://elearn.ucr.edu/
Effective URL: https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
Submission: On November 03 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 169.235.156.27, located in United States and belongs to UCR-EDU, US. The main domain is auth.ucr.edu. The Cisco Umbrella rank of the primary domain is 854867.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on April 6th 2023. Valid for: a year.
This is the only time auth.ucr.edu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 3.87.234.143 14618 (AMAZON-AES)
3 3 3.233.131.11 14618 (AMAZON-AES)
9 169.235.156.27 6106 (UCR-EDU)
9 1
Apex Domain
Subdomains
Transfer
13 ucr.edu
elearn.ucr.edu — Cisco Umbrella Rank: 861998
auth.ucr.edu — Cisco Umbrella Rank: 854867
2 MB
9 1
Domain Requested by
9 auth.ucr.edu auth.ucr.edu
4 elearn.ucr.edu 4 redirects
9 2

This site contains links to these domains. Also see Links.

Domain
www.ucr.edu
myaccount.ucr.edu
goto.ucr.edu
its.ucr.edu
Subject Issuer Validity Valid
*.ucr.edu
Go Daddy Secure Certificate Authority - G2
2023-04-06 -
2024-05-07
a year crt.sh

This page contains 1 frames:

Primary Page: https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
Frame ID: 4F815CC0B7273DE76833C0AC913289E9
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

UCRiverside | Login

Page URL History Show full URLs

  1. http://elearn.ucr.edu/ HTTP 301
    https://elearn.ucr.edu/ HTTP 302
    https://elearn.ucr.edu/login HTTP 302
    https://elearn.ucr.edu/login/cas HTTP 302
    https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • ([\d.]+)/jquery-ui(?:\.min)?\.js
  • jquery-ui.*\.js

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

1786 kB
Transfer

2032 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://elearn.ucr.edu/ HTTP 301
    https://elearn.ucr.edu/ HTTP 302
    https://elearn.ucr.edu/login HTTP 302
    https://elearn.ucr.edu/login/cas HTTP 302
    https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
auth.ucr.edu/cas/
Redirect Chain
  • http://elearn.ucr.edu/
  • https://elearn.ucr.edu/
  • https://elearn.ucr.edu/login
  • https://elearn.ucr.edu/login/cas
  • https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
11 KB
7 KB
Document
General
Full URL
https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.235.156.27 , United States, ASN6106 (UCR-EDU, US),
Reverse DNS
auth.ucr.edu
Software
/
Resource Hash
0c8487efbe59486226509655ea0b40e7c320679d18390432677ef044ac704a34
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Language
de-DE
Content-Type
text/html;charset=UTF-8
Date
Fri, 03 Nov 2023 17:12:45 GMT
Expires
0
Keep-Alive
timeout=20
Pragma
no-cache
Strict-Transport-Security
max-age=15768000 ; includeSubDomains
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-Frame-Options
ALLOW
X-XSS-Protection
1; mode=block
vary
accept-encoding

Redirect headers

cache-control
no-store
content-encoding
br
content-security-policy
frame-ancestors 'self' elearn.ucr.edu ucr.instructure.com ucr.staging.instructure.com ucr.beta.instructure.com ucr.test.instructure.com;
content-type
text/html; charset=utf-8
date
Fri, 03 Nov 2023 17:12:45 GMT
location
https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
p3p
CP="None, see http://www.instructure.com/privacy-policy"
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
Apache
status
302 Found
strict-transport-security
max-age=63072000
vary
Accept-Encoding
x-a11y-ally
Dana Danger Grey
x-canvas-meta
q=6645;a=1;g=cmVowHXgMtUQzx84VJY6XIznaLG0Q7ON0oBCDvlS;s=14493;c=cluster88;z=us-east-1b;o=login/cas;n=new;st=d8ae03cc2a534331b469d63f8f218d75-a0f13bc7fa684170-0;b=1809044;m=1809044;u=0.02;y=0.00;d=0.00;
x-content-type-options
nosniff
x-download-options
noopen
x-permitted-cross-domain-policies
none
x-request-context-id
5642a93a-ac4e-4f26-9114-5c4ce773e0bd
x-request-processor
0d80b13af4f05a879
x-runtime
0.031692
x-session-id
c3dfe0b9380234b023dfbfa968ce99d2
x-xss-protection
1; mode=block
cas.css
auth.ucr.edu/cas/css/
86 KB
87 KB
Stylesheet
General
Full URL
https://auth.ucr.edu/cas/css/cas.css
Requested by
Host: auth.ucr.edu
URL: https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.235.156.27 , United States, ASN6106 (UCR-EDU, US),
Reverse DNS
auth.ucr.edu
Software
/
Resource Hash
6ad22535e0a0e186881a0c26000da6edfd6acfebc566c5ab1dfdc27b9cada67b
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15768000 ; includeSubDomains
Date
Fri, 03 Nov 2023 17:12:45 GMT
X-Content-Type-Options
nosniff
Last-Modified
Fri, 03 Sep 2021 05:29:19 GMT
X-Frame-Options
ALLOW
Content-Type
text/css;charset=UTF-8
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
Content-Length
88440
X-XSS-Protection
1; mode=block
jquery.min.js
auth.ucr.edu/cas/webjars/jquery/3.4.1/
86 KB
30 KB
Script
General
Full URL
https://auth.ucr.edu/cas/webjars/jquery/3.4.1/jquery.min.js
Requested by
Host: auth.ucr.edu
URL: https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.235.156.27 , United States, ASN6106 (UCR-EDU, US),
Reverse DNS
auth.ucr.edu
Software
/
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15768000 ; includeSubDomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Fri, 03 Nov 2023 17:12:45 GMT
Last-Modified
Fri, 03 Sep 2021 05:29:19 GMT
vary
accept-encoding
X-Frame-Options
ALLOW
Content-Type
application/javascript;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
X-XSS-Protection
1; mode=block
jquery-ui.min.js
auth.ucr.edu/cas/webjars/jquery-ui/1.12.1/
248 KB
67 KB
Script
General
Full URL
https://auth.ucr.edu/cas/webjars/jquery-ui/1.12.1/jquery-ui.min.js
Requested by
Host: auth.ucr.edu
URL: https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.235.156.27 , United States, ASN6106 (UCR-EDU, US),
Reverse DNS
auth.ucr.edu
Software
/
Resource Hash
28ce75d953678c4942df47a11707a15e3c756021cf89090e3e6aa7ad6b6971c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15768000 ; includeSubDomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Fri, 03 Nov 2023 17:12:45 GMT
Last-Modified
Fri, 03 Sep 2021 05:29:19 GMT
vary
accept-encoding
X-Frame-Options
ALLOW
Content-Type
application/javascript;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
X-XSS-Protection
1; mode=block
head.min.js
auth.ucr.edu/cas/webjars/headjs/1.0.3/
9 KB
4 KB
Script
General
Full URL
https://auth.ucr.edu/cas/webjars/headjs/1.0.3/head.min.js
Requested by
Host: auth.ucr.edu
URL: https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.235.156.27 , United States, ASN6106 (UCR-EDU, US),
Reverse DNS
auth.ucr.edu
Software
/
Resource Hash
db917fc3741ec881cde5f77f9d0514a27081219aea5b4cbc81a391345f5ae8ac
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15768000 ; includeSubDomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Fri, 03 Nov 2023 17:12:45 GMT
Last-Modified
Fri, 03 Sep 2021 05:29:19 GMT
vary
accept-encoding
X-Frame-Options
ALLOW
Content-Type
application/javascript;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
X-XSS-Protection
1; mode=block
cas.js
auth.ucr.edu/cas/js/
3 KB
2 KB
Script
General
Full URL
https://auth.ucr.edu/cas/js/cas.js
Requested by
Host: auth.ucr.edu
URL: https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.235.156.27 , United States, ASN6106 (UCR-EDU, US),
Reverse DNS
auth.ucr.edu
Software
/
Resource Hash
e27ca00839214b144b6c0eece47217464f8ca1ef63332af00b19873c70c278cb
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15768000 ; includeSubDomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Fri, 03 Nov 2023 17:12:45 GMT
Last-Modified
Fri, 03 Sep 2021 05:29:19 GMT
vary
accept-encoding
X-Frame-Options
ALLOW
Content-Type
application/javascript;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
X-XSS-Protection
1; mode=block
ucr-logo.png
auth.ucr.edu/cas/images/
22 KB
22 KB
Image
General
Full URL
https://auth.ucr.edu/cas/images/ucr-logo.png
Requested by
Host: auth.ucr.edu
URL: https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.235.156.27 , United States, ASN6106 (UCR-EDU, US),
Reverse DNS
auth.ucr.edu
Software
/
Resource Hash
b10118c1119f7b5cb1bac87f6368a0315b04826767a4e04b3cc3c7d0560b1e33
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auth.ucr.edu/cas/login?service=https%3A%2F%2Felearn.ucr.edu%2Flogin%2Fcas
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15768000 ; includeSubDomains
Date
Fri, 03 Nov 2023 17:12:45 GMT
X-Content-Type-Options
nosniff
Last-Modified
Fri, 03 Sep 2021 05:29:19 GMT
X-Frame-Options
ALLOW
Content-Type
image/png;charset=UTF-8
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
Content-Length
22320
X-XSS-Protection
1; mode=block
CAS_2020-f_mask_pt_1920.png
auth.ucr.edu/cas/images/
1 MB
1 MB
Image
General
Full URL
https://auth.ucr.edu/cas/images/CAS_2020-f_mask_pt_1920.png
Requested by
Host: auth.ucr.edu
URL: https://auth.ucr.edu/cas/css/cas.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.235.156.27 , United States, ASN6106 (UCR-EDU, US),
Reverse DNS
auth.ucr.edu
Software
/
Resource Hash
9fc8e056ceb4ddf7cc3ebeff485658ed6a1166520c74c7e42247859b9380f000
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auth.ucr.edu/cas/css/cas.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15768000 ; includeSubDomains
Date
Fri, 03 Nov 2023 17:12:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Fri, 03 Sep 2021 05:29:19 GMT
X-Frame-Options
ALLOW
Content-Type
image/png;charset=UTF-8
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
Content-Length
1512007
X-XSS-Protection
1; mode=block
Oswald-SemiBold.ttf
auth.ucr.edu/cas/fonts/Oswald/
90 KB
90 KB
Font
General
Full URL
https://auth.ucr.edu/cas/fonts/Oswald/Oswald-SemiBold.ttf
Requested by
Host: auth.ucr.edu
URL: https://auth.ucr.edu/cas/css/cas.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.235.156.27 , United States, ASN6106 (UCR-EDU, US),
Reverse DNS
auth.ucr.edu
Software
/
Resource Hash
31dacc472c009d7e364d96d4f21a21ddc3520069d2054c95f6f0c13d29674b42
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block

Request headers

Referer
https://auth.ucr.edu/cas/css/cas.css
Origin
https://auth.ucr.edu
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=15768000 ; includeSubDomains
Date
Fri, 03 Nov 2023 17:12:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Fri, 03 Sep 2021 05:29:19 GMT
X-Frame-Options
ALLOW
Content-Type
application/x-font-ttf;charset=UTF-8
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
Content-Length
91700
X-XSS-Protection
1; mode=block
Expires
0

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery function| head function| requestGeoPosition function| logGeoLocationError function| showGeoPosition function| preserveAnchorTagOnForm function| preventFormResubmission function| resourceLoadedSuccessfully function| loadjQueryUI function| notifyResourcesAreLoaded boolean| trackGeoLocation object| googleAnalyticsTrackingId string| j

7 Cookies

Domain/Path Name / Value
auth.ucr.edu/cas/ Name: TS01235901
Value: 01095325045a468ab085b20efe9499062b969d7a0bd719d81a2033366d6093d67164e87d443804fead3ff75fb0f5b08259ba5d4469488fcbcb96f0d1c96f90acc3ec63a592
elearn.ucr.edu/ Name: log_session_id
Value: c3dfe0b9380234b023dfbfa968ce99d2
elearn.ucr.edu/ Name: _legacy_normandy_session
Value: ymvZ9xWScDXVC4kU9P0Asw.O0wYV68c4vvud7nKjJ-XmI1sl3bX5v39yrG9jDBzXgKq94Y-yvDxKgAppvX2ueckjPHiC6ZpTJkUvCCAFjb3AAkcc0ehvpGZhjqtwGuF7J1LOTSbQCzo5niXP23FXRQgVqxwqTNiBYvjY2aFuF8EoQ.JOD8-1WOdYIBzYyqan0N6snEnyA.ZUUqDA
elearn.ucr.edu/ Name: canvas_session
Value: ymvZ9xWScDXVC4kU9P0Asw.O0wYV68c4vvud7nKjJ-XmI1sl3bX5v39yrG9jDBzXgKq94Y-yvDxKgAppvX2ueckjPHiC6ZpTJkUvCCAFjb3AAkcc0ehvpGZhjqtwGuF7J1LOTSbQCzo5niXP23FXRQgVqxwqTNiBYvjY2aFuF8EoQ.JOD8-1WOdYIBzYyqan0N6snEnyA.ZUUqDA
elearn.ucr.edu/ Name: _csrf_token
Value: NczcqrMyPZLRc0iLppnxFlQmROxXPCdBnpz3nWE6TVFb5%2B3O1V5XxqUJI%2F%2FM8pN1LUQwqwReX3SuycL1IEgHZw%3D%3D
auth.ucr.edu/ Name: BIGipServerp_auth.ucr.edu_8443
Value: 513544364.64288.0000
.auth.ucr.edu/ Name: TS016d2818
Value: 010953250455ad6c97abeb1676514b2d780c0260e3d719d81a2033366d6093d67164e87d442ea61c1c8336ebac34e7714736c604ef070292a3031ee6a58b57740e7f574d50

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW
X-Xss-Protection 1; mode=block