Auth Mgmt API ZAP Scan

[github-actions]

• Site: https://api.epa.gov
  New Alerts

  • Application Error Disclosure [90022] total: 2:
    • https://api.epa.gov/easey/dev/auth-mgmt/sign/send-mobile-code
    • https://api.epa.gov/easey/dev/auth-mgmt/sign/validate
  • Cross-Domain Misconfiguration [10098] total: 2:
    • https://api.epa.gov/easey/dev/auth-mgmt/tokens/client
    • https://api.epa.gov/easey/dev/auth-mgmt/tokens/client/validate
  • A Server Error response code was returned by the server [100000] total: 1:
    • https://api.epa.gov/easey/dev/auth-mgmt/tokens/validate
  • Application Error Disclosure [90022] total: 1:
    • https://api.epa.gov/easey/dev/auth-mgmt/tokens/validate
  • Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) [10035] total: 12:
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-out
    • https://api.epa.gov/easey/dev/auth-mgmt/certifications/statements?monitorPlanIds=monitorPlanIds
    • https://api.epa.gov/easey/dev/auth-mgmt/permissions?userId=userId
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-in
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/update-last-activity
    • ..
  • A Client Error response code was returned by the server [100000] total: 11:
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-out
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-in
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/update-last-activity
    • https://api.epa.gov/easey/dev/auth-mgmt/certifications/verify-challenge
    • https://api.epa.gov/easey/dev/auth-mgmt/certifications/verify-credentials
    • ..
  • Authentication Request Identified [10111] total: 3:
    • https://api.epa.gov/easey/dev/auth-mgmt/certifications/verify-credentials
    • https://api.epa.gov/easey/dev/auth-mgmt/sign/authenticate
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-in
  • Information Disclosure - Sensitive Information in URL [10024] total: 1:
    • https://api.epa.gov/easey/dev/auth-mgmt/permissions?userId=userId
  • Non-Storable Content [10049] total: 11:
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-out
    • https://api.epa.gov/easey/dev/auth-mgmt/permissions?userId=userId
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-in
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/update-last-activity
    • https://api.epa.gov/easey/dev/auth-mgmt/sign/authenticate
    • ..
  • Retrieved from Cache [10050] total: 12:
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-out
    • https://api.epa.gov/easey/dev/auth-mgmt/certifications/statements?monitorPlanIds=monitorPlanIds
    • https://api.epa.gov/easey/dev/auth-mgmt/permissions?userId=userId
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-in
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/update-last-activity
    • ..

• Site: https://api-easey-dev.app.cloud.gov
  New Alerts

  • Unexpected Content-Type was returned [100001] total: 4:
    • https://api-easey-dev.app.cloud.gov/winscp.ini
    • https://api-easey-dev.app.cloud.gov/WS_FTP.ini
    • https://api-easey-dev.app.cloud.gov?aaa=bbb
    • https://api-easey-dev.app.cloud.gov?class.module.classLoader.DefaultAssertionStatus=nonsense
  • A Client Error response code was returned by the server [100000] total: 67:
    • https://api-easey-dev.app.cloud.gov
    • https://api-easey-dev.app.cloud.gov/
    • https://api-easey-dev.app.cloud.gov/._darcs
    • https://api-easey-dev.app.cloud.gov/.bzr
    • https://api-easey-dev.app.cloud.gov/.DS_Store
    • ..
  • Non-Storable Content [10049] total: 1:
    • https://api-easey-dev.app.cloud.gov/auth-mgmt/swagger-json

View the following link to download the report.
RunnerID:5560860703

[github-actions]

• Site: https://api.epa.gov
  New Alerts

  • Sec-Fetch-Dest Header is Missing [90005] total: 2:
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-in
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/update-last-activity
  • Sec-Fetch-Mode Header is Missing [90005] total: 2:
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-in
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/update-last-activity
  • Sec-Fetch-Site Header is Missing [90005] total: 2:
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-in
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/update-last-activity
  • Sec-Fetch-User Header is Missing [90005] total: 2:
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/sign-in
    • https://api.epa.gov/easey/dev/auth-mgmt/authentication/update-last-activity

• Site: https://api-easey-dev.app.cloud.gov
  New Alerts

  • Sec-Fetch-Dest Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/auth-mgmt/swagger-json
  • Sec-Fetch-Mode Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/auth-mgmt/swagger-json
  • Sec-Fetch-Site Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/auth-mgmt/swagger-json
  • Sec-Fetch-User Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/auth-mgmt/swagger-json

View the following link to download the report.
RunnerID:5629257432