Security - https://www.bing.com BeaverCheck Audit

D

Cookie Security

Action

11 cookies analyzed, 5 checks passed

FIX

11 cookies analyzed, 5 checks passed

Cookie 'MUID' has the Secure flag

Cookie 'MUID' is missing the HttpOnly flag

Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.

Cookie 'MUID' has SameSite=None

Cookie 'MUIDB' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie 'MUIDB' has the HttpOnly flag

Cookie 'MUIDB' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

Cookie '_EDGE_S' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie '_EDGE_S' has the HttpOnly flag

Cookie '_EDGE_S' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

Cookie '_EDGE_V' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie '_EDGE_V' has the HttpOnly flag

Cookie '_EDGE_V' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

Cookie 'SRCHD' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie 'SRCHD' is missing the HttpOnly flag

Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.

Cookie 'SRCHD' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

Cookie 'SRCHUID' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie 'SRCHUID' is missing the HttpOnly flag

Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.

Cookie 'SRCHUID' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

Cookie 'SRCHUSR' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie 'SRCHUSR' is missing the HttpOnly flag

Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.

Cookie 'SRCHUSR' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

Cookie 'SRCHHPGUSR' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie 'SRCHHPGUSR' is missing the HttpOnly flag

Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.

Cookie 'SRCHHPGUSR' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

Cookie '_SS' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie '_SS' is missing the HttpOnly flag

Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.

Cookie '_SS' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

Cookie 'ULC' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie 'ULC' is missing the HttpOnly flag

Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.

Cookie 'ULC' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

Cookie '_HPVN' is missing the Secure flag

Without the Secure flag, this cookie can be sent over unencrypted HTTP, exposing it to interception.

Cookie '_HPVN' is missing the HttpOnly flag

Without HttpOnly, this cookie can be accessed by JavaScript, making it vulnerable to XSS-based theft.

Cookie '_HPVN' has no SameSite attribute

Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict.

11 cookies analyzed 10 critical 18 warnings

Name	Secure	HttpOnly	SameSite	Size	Issues
MUID	✓	✗	None	36 B	1
MUIDB	✗	✓	—	37 B	2
_EDGE_S	✗	✓	—	47 B	2
_EDGE_V	✗	✓	—	8 B	2
SRCHD	✗	✗	—	14 B	3
SRCHUID	✗	✗	—	57 B	3
SRCHUSR	✗	✗	—	19 B	3
SRCHHPGUSR	✗	✗	—	21 B	3
_SS	✗	✗	—	39 B	3
ULC	✗	✗	—	3 B	3
_HPVN	✗	✗	—	328 B	3

F

Empty Page Detection

Action

1 empty-page signal(s) detected -- page may be a placeholder or have content-rendering bugs

FIX

1 empty-page signal(s) detected -- page may be a placeholder or have content-rendering bugs

Page body has only 32 chars of text -- likely empty / placeholder

After HTML stripping, the page body contains 32 characters of text content. Below 200 chars almost always means: (1) the page is a placeholder that was never filled in, (2) JavaScript was supposed to render content but failed, (3) the page is a redirect / interstitial / wrapper that should have a real status code other than 200, or (4) it's a legitimately small page like a single-form login (in which case this finding is a false positive that confirms 'minimal content' is intentional). Review the page in a browser. If content is missing, the most common root cause is a JS-rendering pipeline that needs prerendering or server-side rendering for crawlers / scanners to capture content.

Got: 32 chars

F

Subresource Integrity Adoption

Action

0% SRI adoption (0/37 third-party resources)

FIX

0% SRI adoption (0/37 third-party resources)

SRI adoption: 0/37 third-party resources protected (0%)

Of 37 third-party `<script>` / `<link rel=stylesheet>` resources, 0 (0%) declare a Subresource Integrity hash via the `integrity=` attribute. SRI binds the page to the exact bytes of the third-party resource: if the CDN is compromised, attacker-modified bytes won't match the declared hash and the browser refuses to execute the resource. Missing SRI on (first 5 examples): - https://r.bing.com/rs/2E/K/cc,nc/--1W9A1f5-07ByL9YFMiY5p9LQU.css?or=w - https://r.bing.com/rs/4q/gM/cc,nc/07goh3UcBfqcS932cBgUIxdsGJA.css?or=w - https://r.bing.com/rs/4q/gp/cc,nc/X4V-IGCTgDxO69tbgGcZokQyezI.css?or=w - https://r.bing.com/rb/2A/cir3,cc,nc/t6ilQvdm1Kf1VaabvAwljycjim4.css?bu=CPIB9QGWAqgCmQKZApkC5AI&or=w - https://r.bing.com/rp/wczR3URZR4-oWjjc5idYK8_hr54.br.css Fix: add `integrity="sha384-..."` and `crossorigin="anonymous"` attributes. Generators: srihash.org, or in-browser via `await crypto.subtle.digest('SHA-384', bytes)`. Cache-bust the resource URL when you change versions, since the integrity hash will mismatch with old cached bytes.

Got: 0% (0/37)

F

Permissions-Policy Granularity

Action

0% high-risk feature coverage (0/10)

FIX

0% high-risk feature coverage (0/10)

Permissions-Policy covers 0/10 high-risk features (0%)

The Permissions-Policy header explicitly declares policies for 0/10 high-risk features. Covered: Not declared (default-allow): camera, microphone, geolocation, payment, usb, serial, midi, accelerometer, gyroscope, magnetometer The non-declared features fall back to their spec-default policy (usually `self`), which means an XSS-injected or compromised iframe could request them. For features the page genuinely doesn't use, declare `feature=()` to fully close them.

Got: 0% (0/10)

F

Subresource Integrity

Action

0 of 37 external resources have SRI

FIX

0 of 37 external resources have SRI

External link from r.bing.com lacks integrity attribute