ZAP Full Scan Report

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • Bypassing 403 [40038] total: 5:
    • http://localhost:8080/css%20/
    • http://localhost:8080/css/bootstrap%20/
    • http://localhost:8080/css/prettify%20/
    • http://localhost:8080/img%20/
    • http://localhost:8080/js%20/
  • Vulnerable JS Library [10003] total: 1:
    • http://localhost:8080/js/bootstrap-3.4.1.js
  • Dangerous JS Functions [10110] total: 3:
    • http://localhost:8080/js/jquery-3.7.0.js
    • http://localhost:8080/js/legacy.js?1.6.0
    • http://localhost:8080/js/prettify.js?1.6.0
  • Permissions Policy Header Not Set [10063] total: 11:
    • http://localhost:8080/js/base-x-4.0.0.js
    • http://localhost:8080/js/bootstrap-3.4.1.js
    • http://localhost:8080/js/jquery-3.7.0.js
    • http://localhost:8080/js/kjua-0.9.0.js
    • http://localhost:8080/js/legacy.js?1.6.0
    • ..
  • Non-Storable Content [10049] total: 3:
    • http://localhost:8080
    • http://localhost:8080/
    • http://localhost:8080/sitemap.xml

  • Storable and Cacheable Content [10049] total: 8:

    • http://localhost:8080/css/bootstrap/bootstrap-3.4.1.css
    • http://localhost:8080/css/bootstrap/bootstrap-theme-3.4.1.css
    • http://localhost:8080/css/bootstrap/privatebin.css?1.6.0
    • http://localhost:8080/css/noscript.css
    • http://localhost:8080/css/prettify/prettify.css?1.6.0
    • ..

    Ignored Alerts

  • Absence of Anti-CSRF Tokens [10202] total: 3:
  • CSP: Wildcard Directive [10055] total: 6:
  • CSP: script-src unsafe-eval [10055] total: 6:
  • CSP: Header & Meta [10055] total: 3:
  • Information Disclosure - Suspicious Comments [10027] total: 16:
  • Modern Web Application [10109] total: 3:

View the following link to download the report. RunnerID:6715206329

[rugk]

Storable and Cacheable Content

Do we miss some caching headers for these @elrido?

[elrido]

To me these reports are confusing: The JS and CSS are reported because they are cachable, while the dynamic content is because it's not. There should not be any special headers necessary for browsers to cache static content. For the dynamic content we do emit a limited lifetime for caching as a header.

[rugk]

Maybe it is because that caching then is only a heuristic and not reliable? Did not find a guideline right now, but maybe one should better explicitly specify how long it should cache stuff like this?