# morhadotsan/http_intercept architecture

> Architecture diagram of the GitHub repository morhadotsan/http_intercept, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/morhadotsan/http_intercept
- Repository: https://github.com/morhadotsan/http_intercept

## Overview

http_intercept is a self-hosted HTTP security-header scanner. The user submits a URL in the browser; PHP validates it, calls the Flask analyzer, and stores the scan in SQLite. The analyzer fetches the target response, evaluates ten header/security rules, and grades the results. The UI also supports browsing scan history and comparing two scans. Rule implementations are grouped because their individual modules are independent checks. The README documents this architecture; sampled files show the scan, scoring, persistence, history, and comparison paths.

Main entry points: [`web/public/main.js`](https://github.com/morhadotsan/http_intercept/blob/main/web/public/main.js) (UI controller), [`web/api/scan.php`](https://github.com/morhadotsan/http_intercept/blob/main/web/api/scan.php) (Scan API), [`analyzer/app.py`](https://github.com/morhadotsan/http_intercept/blob/main/analyzer/app.py) (Flask scanner), [`web/lib/db.php`](https://github.com/morhadotsan/http_intercept/blob/main/web/lib/db.php) (Database access)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["Web application"]
  node_ui["Scan UI<br/>[index.php]"]
  node_ui_controller["UI controller<br/>[main.js]"]
  node_scan_api["Scan API<br/>[scan.php]"]
  node_history_api["History API<br/>[history.php]"]
  node_compare_api["Compare API<br/>[compare.php]"]
  node_url_validation["URL validation<br/>[sanitize.php]"]
  node_analyzer_bridge["Analyzer bridge"]
end

subgraph group_analyzer["Scan analyzer"]
  node_analyzer_service["Flask scanner<br/>[app.py]"]
  node_security_rules["Security rules"]
  node_scoring["Score and grade<br/>[scoring.py]"]
end

subgraph group_storage["Persistence"]
  node_database_access["Database access<br/>[db.php]"]
  node_scan_database[("Scan records<br/>[db.php]")]
end

node_browser(("Browser user"))
node_target_site(("Target website"))

node_browser -->|"uses"| node_ui
node_ui -->|"loads"| node_ui_controller
node_ui_controller -->|"submits scan"| node_scan_api
node_ui_controller -->|"loads history"| node_history_api
node_ui_controller -->|"requests comparison"| node_compare_api
node_scan_api -->|"validates URL"| node_url_validation
node_scan_api -->|"requests scan"| node_analyzer_bridge
node_analyzer_bridge -->|"POSTs scan"| node_analyzer_service
node_analyzer_service -->|"fetches response"| node_target_site
node_analyzer_service -->|"evaluates headers"| node_security_rules
node_analyzer_service -->|"scores results"| node_scoring
node_scan_api -->|"persists scan"| node_database_access
node_database_access -->|"creates schema"| node_scan_database
node_history_api -->|"queries history"| node_database_access
node_history_api -->|"validates URL"| node_url_validation
node_compare_api -->|"loads scans"| node_database_access
node_compare_api -->|"cleans IDs"| node_url_validation

click node_ui "https://github.com/morhadotsan/http_intercept/blob/main/web/index.php"
click node_ui_controller "https://github.com/morhadotsan/http_intercept/blob/main/web/public/main.js"
click node_scan_api "https://github.com/morhadotsan/http_intercept/blob/main/web/api/scan.php"
click node_history_api "https://github.com/morhadotsan/http_intercept/blob/main/web/api/history.php"
click node_compare_api "https://github.com/morhadotsan/http_intercept/blob/main/web/api/compare.php"
click node_url_validation "https://github.com/morhadotsan/http_intercept/blob/main/web/lib/sanitize.php"
click node_analyzer_bridge "https://github.com/morhadotsan/http_intercept/blob/main/web/lib/analyzer_client.php"
click node_analyzer_service "https://github.com/morhadotsan/http_intercept/blob/main/analyzer/app.py"
click node_security_rules "https://github.com/morhadotsan/http_intercept/tree/main/analyzer/rules"
click node_scoring "https://github.com/morhadotsan/http_intercept/blob/main/analyzer/scoring.py"
click node_database_access "https://github.com/morhadotsan/http_intercept/blob/main/web/lib/db.php"
click node_scan_database "https://github.com/morhadotsan/http_intercept/blob/main/web/lib/db.php"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ui,node_ui_controller,node_scan_api,node_history_api,node_compare_api,node_url_validation,node_analyzer_bridge,node_browser toneBlue
class node_analyzer_service,node_security_rules,node_scoring toneAmber
class node_database_access,node_scan_database toneMint
class node_target_site toneIndigo
```

## Components

### Web application

- [Scan UI](https://github.com/morhadotsan/http_intercept/blob/main/web/index.php): `web/index.php`
- [UI controller](https://github.com/morhadotsan/http_intercept/blob/main/web/public/main.js): `web/public/main.js`
- [Scan API](https://github.com/morhadotsan/http_intercept/blob/main/web/api/scan.php): `web/api/scan.php`
- [History API](https://github.com/morhadotsan/http_intercept/blob/main/web/api/history.php): `web/api/history.php`
- [Compare API](https://github.com/morhadotsan/http_intercept/blob/main/web/api/compare.php): `web/api/compare.php`
- [URL validation](https://github.com/morhadotsan/http_intercept/blob/main/web/lib/sanitize.php): `web/lib/sanitize.php`
- [Analyzer bridge](https://github.com/morhadotsan/http_intercept/blob/main/web/lib/analyzer_client.php): `web/lib/analyzer_client.php`

### Scan analyzer

- [Flask scanner](https://github.com/morhadotsan/http_intercept/blob/main/analyzer/app.py): `analyzer/app.py`
- [Security rules](https://github.com/morhadotsan/http_intercept/tree/main/analyzer/rules): `analyzer/rules`
- [Score and grade](https://github.com/morhadotsan/http_intercept/blob/main/analyzer/scoring.py): `analyzer/scoring.py`

### Persistence

- [Database access](https://github.com/morhadotsan/http_intercept/blob/main/web/lib/db.php): `web/lib/db.php`
- [Scan records](https://github.com/morhadotsan/http_intercept/blob/main/web/lib/db.php): `web/lib/db.php`

### Other components

- **Browser user**
- **Target website**

## Connections

- Browser user → Scan UI: uses (evidence: `README.md`)
- Scan UI → UI controller: loads (evidence: `web/index.php`)
- UI controller → Scan API: submits scan (evidence: `web/public/main.js`)
- UI controller → History API: loads history (evidence: `web/public/main.js`)
- UI controller → Compare API: requests comparison (evidence: `web/public/main.js`)
- Scan API → URL validation: validates URL (evidence: `web/api/scan.php`)
- Scan API → Analyzer bridge: requests scan (evidence: `web/api/scan.php`)
- Analyzer bridge → Flask scanner: POSTs scan (evidence: `web/lib/analyzer_client.php`)
- Flask scanner → Target website: fetches response (evidence: `analyzer/app.py`)
- Flask scanner → Security rules: evaluates headers (evidence: `analyzer/app.py`)
- Flask scanner → Score and grade: scores results (evidence: `analyzer/app.py`)
- Scan API → Database access: persists scan (evidence: `web/api/scan.php`)
- Database access → Scan records: creates schema (evidence: `web/lib/db.php`)
- History API → Database access: queries history (evidence: `web/api/history.php`)
- History API → URL validation: validates URL (evidence: `web/api/history.php`)
- Compare API → Database access: loads scans (evidence: `web/api/compare.php`)
- Compare API → URL validation: cleans IDs (evidence: `web/api/compare.php`)