Open psiinon opened 4 years ago
I'm willing to pick this up.
My plan was to update the Access-Control-Allow-Origin
header in onHttpResponseReceive
as described in the stackoverflow post.
I'm new to the gradle/java world and do not know how I can best debug this app? Any advice?
Hi @psiinon , what's the status on this issue?
Does not seem to be actively worked on.
Does not seem to be actively worked on.
I can see that @jveldhuijzen has pushed a commit, have you reviewed that?
That's not a pull request (in any case that's not finished, e.g. setting other header).
For info ZAP already optionally strips out CSP. The relevant code for this:
To fix this issue we'll need to do something similar.
Is this message in HUD tutorial also explaining the current problem?
If HTTP sites (is not HTTPS ones) use the Access-Control-Allow-Origin header then the site will typically not work. ZAP should automatically fix this header. https://stackoverflow.com/questions/61940616/how-do-i-work-with-http-sites-using-the-hud-in-owasps-zap-proxy