Mark Nottingham

https://www.cspvalidator.org/

Thor doesn't support HTTP/2. Right now this is pretty low-priority; REDbot focuses mostly on HTTP semantics, not the details of the on-the-wire implementation.

demo url: http://caclubindia.s3.amazonaws.com/static/styles_rp/bootstrap_edit.css

that url seems to have used PKZIP; see https://github.com/madler/zlib/blob/50893291621658f355bc5b4d450a8d06a563053d/infback.c#L367 https://github.com/madler/zlib/issues/82

Some caches (not many) don't reuse with uppercased max-age, so probably good to warn. See https://cache-tests.fyi/?id=freshness-max-age-case-insenstive&id=cc-resp-no-store-case-insensitive#

Also possibly in `_utils.py:parse_param()` (`k_norm = key.lower()`).

- [ ] #222 Subresource Integrity - [ ] #153 HPKP - [ ] #60 CSP - [ ] #223 HSTS - [ ] #224 CORS - [ ] #225...

Have it working, roughed in like this: 

Open questions: - [x] Get it into HAR, TXT output - [ ] Make sure Notes are going to the right destination - [ ] options line (e.g., response header...

I want to make sure it calls this out as an error in a good way.