[feature] Abilty to include headers in the text for changedetection.io - PCI DSS 11.6.1 Compliance: Detecting Unauthorized HTTP Header Changes with Chrome CDP & Changedetection.io

Adding "reply headers" to the "fetchers" would be amazing, this would be very helpful to a lot of people who want to monitor headers. It wouldnt be so hard..

- Add "reply headers" to the "fetchers"
- Add a checkbox that prepends the text of the reply headers to the `text_json_diff` processor

the only bit i'm not sure about is "Provide logs of captured request/response headers from a monitoring system.", because it will just check it and only report if something changes?

**_Here's what chatgpt says_**

PCI DSS 4.0 (including 4.0.1) compliance requirement **11.6.1** relates to **change detection mechanisms** for unauthorized modifications to HTTP headers and payment page content. Specifically, it is designed to detect tampering with e-commerce payment pages, which could indicate a **Magecart**-style attack (where malicious scripts steal cardholder data).

### How Request Headers Are Relevant in PCI DSS 11.6.1

The standard itself does not explicitly say, **"You must collect and store request headers."** However, the intent of **11.6.1** is to ensure that **unauthorized changes to the payment page environment (including HTTP request headers and responses) are detected and logged.** This is why security auditors may ask to review request headers.

#### **Breakdown of PCI DSS 11.6.1 Requirements**
- A **change detection mechanism** must be deployed to **identify unauthorized modifications** to HTTP headers or payment page content.
- This applies to pages **that directly handle payment details** or **redirect users to a third-party processor**.
- The mechanism must operate at least **every 7 days**.
- Any unauthorized modifications must trigger **alerts and investigation**.

### **Why Request Headers Matter**
- **Headers can be modified by attackers** to inject malicious scripts (e.g., Magecart attacks).
- A **man-in-the-middle (MITM) attack** or malicious browser extension could alter headers to modify the payment page.
- **Content security policies (CSP), referrer headers, or other HTTP controls** can indicate unauthorized modifications.
- **Ensuring integrity of security-related headers** (e.g., `Content-Security-Policy`, `X-Frame-Options`) is a key control.

### **How to Demonstrate Compliance (for Headers)**
1. **Monitoring Solutions**:
- Use **Changedetection.io** (if feasible for your case) or other tools to detect unauthorized header changes.
- Deploy a **Web Application Firewall (WAF)** or **Content Security Policy (CSP)** logging mechanism.

2. **Evidence Collection**:
- Provide logs of **captured request/response headers** from a monitoring system.
- Use **SIEM (Security Information and Event Management)** tools to track and detect anomalies.
- Show that the change detection tool is **periodically reviewing and alerting on changes**.

3. **Testing & Reporting**:
- Conduct **periodic integrity checks** on the headers of payment pages.
- Document **anomalies or incidents** where changes were detected and resolved.

### **Conclusion**
The PCI DSS 4.0.1 standard itself does not explicitly require storing request headers, but it **requires monitoring for unauthorized changes** to HTTP headers and payment pages. If an auditor asks for request headers, they likely want proof that **header integrity is being checked** as part of compliance with **11.6.1**.

Would you like recommendations on tools for automating this monitoring?

----

For example, `playwright` (`pypuppter-ng`), also needs to be handled by `requests`

```
browser = await launch(headless=True)
page = await browser.newPage()

# Enable network tracking
await page._client.send('Network.enable')

# Intercept and log request headers
page._client.on('Network.requestWillBeSent', lambda req:
print("Request Headers:", req['request']['headers'])
)

# Intercept and log response headers
page._client.on('Network.responseReceived', lambda res:
print("Response Headers:", res['response']['headers'])
)

# Navigate to a test page
await page.goto('https://example.com')

await browser.close()

```

Start by tracing the fetchers, including the Playwright/pyppeteer-ng and requests paths mentioned in the issue, then follow the text_json_diff processor entry point. Confirm how response headers are exposed and how the checkbox setting reaches the processor. Done means header changes can be detected through the supported fetchers without changing normal text monitoring.

Written by the indexing model from the issue text.