Closed execveat closed 1 year ago
This was probably meant as a convenience option - to autoguess auth headers from the observed traffic. However due to race conditions it makes testing on some websites very annoying.
Consider making it a toggleable option. Or maybe expose observed headers in a separate UI element.
This was probably meant as a convenience option - to autoguess auth headers from the observed traffic. However due to race conditions it makes testing on some websites very annoying.
Yup, that was to auto-guess auth headers. It's the magic sauce of the Burp InQL version.
This part is done. Right now headers are passed alongside request when it's sent from Repeater or other Burp interface. Still need to reimplement UI for custom headers, but that's another issue.
Describe the bug Sending requests from "InQL Scanner" to "Repeater" should inherit headers used during introspection query, not headers seen in other traffic.
To Reproduce Steps to reproduce the behavior:
Expected behavior Only generic headers used during querying GraphQL schema should be sent to the Repeater.