ZAP by Checkmarx Scanning Report

Alerts

1. Risk=Informational, Confidence=High (1)

   1. http://localhost:8080 (1)

      1. Authentication Request Identified (1)

         1. POST http://localhost:8080/api/auth/login

            Alert tags
            Alert description	The given request has been identified as an authentication request. The 'Other Info' field contains a set of key=value lines which identify any relevant fields. If the request is in a context which has an Authentication Method set to "Auto-Detect" then this rule will change the authentication to match the request identified.
            Other info	userParam=username userValue=testuser passwordParam=password
            Request	Request line and header section (311 bytes) POST http://localhost:8080/api/auth/login HTTP/1.1 host: localhost:8080 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/json; charset=utf-8 content-length: 44 Request body (44 bytes) {"username":"testuser","password":"Test123"}
            Response	Status line and header section (422 bytes) HTTP/1.1 200 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Content-Security-Policy: default-src 'self' Content-Type: application/json Date: Mon, 08 Dec 2025 02:56:20 GMT content-length: 193 Response body (193 bytes) {"success":true,"message":"Login successfully","token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0dXNlciIsImlhdCI6MTc2NTE2MjU4MCwiZXhwIjoxNzY1MjQ4OTgwfQ.d1yruQmw96EAN2EX8lPKZFxtjys_OHViUZBE66b7tO4"}
            Parameter	username
            Evidence	password
            Solution	This is an informational alert rather than a vulnerability and so there is nothing to fix.

2. Risk=Informational, Confidence=Medium (2)

   1. http://localhost:8080 (2)

      1. Session Management Response Identified (1)

         1. POST http://localhost:8080/api/auth/login

            Alert tags
            Alert description	The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to "Auto-Detect" then this rule will change the session management to use the tokens identified.
            Other info	json:token
            Request	Request line and header section (311 bytes) POST http://localhost:8080/api/auth/login HTTP/1.1 host: localhost:8080 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/json; charset=utf-8 content-length: 44 Request body (44 bytes) {"username":"testuser","password":"Test123"}
            Response	Status line and header section (422 bytes) HTTP/1.1 200 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Content-Security-Policy: default-src 'self' Content-Type: application/json Date: Mon, 08 Dec 2025 02:56:20 GMT content-length: 193 Response body (193 bytes) {"success":true,"message":"Login successfully","token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0dXNlciIsImlhdCI6MTc2NTE2MjU4MCwiZXhwIjoxNzY1MjQ4OTgwfQ.d1yruQmw96EAN2EX8lPKZFxtjys_OHViUZBE66b7tO4"}
            Parameter	token
            Evidence	token
            Solution	This is an informational alert rather than a vulnerability and so there is nothing to fix.

      2. User Agent Fuzzer (1)

         1. POST http://localhost:8080/api/auth/login

            Alert tags	CUSTOM_PAYLOADS = POLICY_PENTEST = SYSTEMIC
            Alert description	Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.
            Request	Request line and header section (409 bytes) POST http://localhost:8080/api/auth/login HTTP/1.1 host: localhost:8080 user-agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1) pragma: no-cache cache-control: no-cache content-type: application/json; charset=utf-8 content-length: 44 Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0dXNlciIsImlhdCI6MTc2NTE2MjcyMywiZXhwIjoxNzY1MjQ5MTIzfQ.J96vq4bRaSb7dxOfcPociaaL08FrysTpKWcTaggem0k Request body (44 bytes) {"username":"testuser","password":"Test123"}
            Response	Status line and header section (422 bytes) HTTP/1.1 200 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Content-Security-Policy: default-src 'self' Content-Type: application/json Date: Mon, 08 Dec 2025 02:58:43 GMT content-length: 193 Response body (193 bytes) {"success":true,"message":"Login successfully","token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0dXNlciIsImlhdCI6MTc2NTE2MjcyMywiZXhwIjoxNzY1MjQ5MTIzfQ.J96vq4bRaSb7dxOfcPociaaL08FrysTpKWcTaggem0k"}
            Parameter	Header User-Agent
            Attack	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)