ZAP Scan Baseline Report

[github-actions[bot]]

• Site: http://127.0.0.1:8000 New Alerts
  • Absence of Anti-CSRF Tokens [10202] total: 1:
    • http://127.0.0.1:8000/accounts/google/login/
  • Content Security Policy (CSP) Header Not Set [10038] total: 12:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/login/
    • http://127.0.0.1:8000/opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/django/core/handlers/base.py,
    • ..
  • Application Error Disclosure [90022] total: 3:
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/robots.txt
    • http://127.0.0.1:8000/accounts/google/login/
  • Cookie No HttpOnly Flag [10010] total: 10:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/accounts/google/login/?process=login
    • http://127.0.0.1:8000/accounts/login/
    • http://127.0.0.1:8000/accounts/signup/
    • ..
  • Permissions Policy Header Not Set [10063] total: 12:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/login/
    • http://127.0.0.1:8000/opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/django/core/handlers/base.py,
    • ..
  • Private IP Disclosure [2] total: 3:
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/robots.txt
    • http://127.0.0.1:8000/accounts/google/login/
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 12:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/a9
    • http://127.0.0.1:8000/broken_access_control
    • http://127.0.0.1:8000/cmd
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 9:
    • http://127.0.0.1:8000/static/css/dark-theme.css
    • http://127.0.0.1:8000/static/css/home.css
    • http://127.0.0.1:8000/static/css/playground.css
    • http://127.0.0.1:8000/static/Lab/icons/pygoat-mini.png
    • http://127.0.0.1:8000/static/Lab/icons/pygoat-mini.svg
    • ..
  • Authentication Request Identified [10111] total: 2:
    • http://127.0.0.1:8000/accounts/login/
    • http://127.0.0.1:8000/login/
  • Modern Web Application [10109] total: 8:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/login/
    • http://127.0.0.1:8000/register
    • http://127.0.0.1:8000/robots.txt
    • ..
  • Non-Storable Content [10049] total: 11:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/a9
    • http://127.0.0.1:8000/broken_access_control
    • ..
  • Session Management Response Identified [10112] total: 6:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/login/
    • http://127.0.0.1:8000/register
    • http://127.0.0.1:8000/register
    • ..
  • Storable and Cacheable Content [10049] total: 1:
    • http://127.0.0.1:8000/sitemap.xml
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 11:
    • http://127.0.0.1:8000/accounts/login/
    • http://127.0.0.1:8000/accounts/login/
    • http://127.0.0.1:8000/accounts/signup/
    • http://127.0.0.1:8000/accounts/signup/
    • http://127.0.0.1:8000/accounts/signup/
    • ..

View the following link to download the report. RunnerID:11988322013

---

ZAP by Checkmarx