3

Are there any issues that can be ignored from ZAP scanner results? I know there is a thread here on issues that can be ignored in BURP suite here. However, those issues are informational, but those same issues are low risk (not informational) in ZAP.

This is the thread I'm talking about: Informational Issues in BURP Scan Report

In particular, I want to know if the below errors can be ignored as part of security review.

X-Frame-Options Header Not Set Web Browser XSS Protection Not Enabled Incomplete or No Cache-control and Pragma HTTP Header Set Cookie set without HttpOnly flag Password Field with Autocomplete enabled X-Content-Type-Options Header Missing

Improve this question
2

You can ignore the following:

  • X-Frame-Options Header Not Set
  • Web Browser XSS Protection Not Enabled
  • Incomplete or No Cache-control and Pragma HTTP Header Set
  • Cookie set without HttpOnly flag
  • Password Field with Autocomplete enabled

As shown on this Chatter group.

Though Salesforce still recommend that you address the issues if you can.

Improve this answer
1
  • 1
    Hey @andynormancx , I have some more issue please give suggestion for these issue. 1. Path Traversal - High (Medium) 2. Session ID in URL Rewrite - Medium (High) 3. X-Content-Type-Options Header Missing - Low (Medium) 4. Cookie Without Secure Flag - Low (Medium) – Avanish Kumar Jul 19 '16 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.