ZAP Scanning Report

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

script-src includes unsafe-eval.

script-src includes unsafe-eval.

script-src includes unsafe-eval.

Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

script-src includes unsafe-inline.

script-src includes unsafe-inline.

script-src includes unsafe-inline.

Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

style-src includes unsafe-inline.

style-src includes unsafe-inline.

style-src includes unsafe-inline.

Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.

The response appears to contain suspicious comments which may help an attacker.

The following pattern was used: \bLATER\b and was detected in likely comment: "// Store code_verifier in sessionStorage for later use (fallback)", see evidence field for the suspicious comment/snippet.

The following pattern was used: \bFROM\b and was detected 3 times, the first in likely comment: "/**

* Generates code challenge from code verifier (SHA256 + base64url)

* Uses Web Crypto API for SHA256

* @aut", see evidence field for the suspicious comment/snippet.

The following pattern was used: \bUSER\b and was detected 2 times, the first in likely comment: "// Poll for up to 60 seconds (500ms * 120) - user might take time to login", see evidence field for the suspicious comment/snippet.

The following pattern was used: \bFROM\b and was detected 2 times, the first in likely comment: "/**

* Generates code challenge from code verifier (SHA256 + base64url)

* @author Angelo Cimino

*/", see evidence field for the suspicious comment/snippet.

The following pattern was used: \bQUERY\b and was detected in likely comment: "// Get redirect URI from current URL (remove query params except code_verifier and main_app_url)", see evidence field for the suspicious comment/snippet.

Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.

The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.

No links have been found while there are scripts, which is an indication that this is a modern web application.

No links have been found while there are scripts, which is an indication that this is a modern web application.

This is an informational alert and so no changes are required.

The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached.

For secure content, ensure the cache-control HTTP header is set with "no-cache, no-store, must-revalidate". If an asset should be cached consider setting the directives "public, max-age, immutable".

Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.