HTTP Security Headers & Cookie Attribute Triage

HTTP/2 200 OK
Date: Sun, 18 Oct 2026 12:00:00 GMT
Server: nginx/1.24.0 (Ubuntu)
Content-Type: application/json; charset=utf-8
Content-Length: 184
Connection: keep-alive
Set-Cookie: session_id=s%3A7f8a9e1b4c2d.qZ8w2xY; Path=/; Domain=apexcore.bank
Set-Cookie: csrf_token=a9f3b82c1e4d5a; Path=/; SameSite=Lax
X-Content-Type-Options: nosniff
X-Frame-Options: ALLOWALL
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline';
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Permitted-Cross-Domain-Policies: all
X-Audit-Checkpoint: n0perm{strict_csp_and_secure_samesite_2026}