Ensure scanners are in place for API runtime security weaknesses

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Audit: Ensure a dynamic API scanning tool is set up to identify API-specific vulnerabilities and that every project that contains an APi is scanned by it. - The DAST-API template must be configured for your project. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Review the output from the scan in Secure > Vulnerability Report

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

1. Include the DAST-API.gitlab-ci.yml template in your .gitlab-ci.yml file. 2. The configuration file has several testing profiles defined with different checks enabled. Select a profile and provide it by adding the DAST_API_PROFILE CI/CD variable to your .gitlab-ci.yml file. 3. Provide the location of the OpenAPI Specification as either a file or URL. Specify the location by adding the DAST_API_OPENAPI variable. 4. The target API instance’s base URL is also required. Provide it by using the DAST_API_TARGET_URL variable or an environment_url.txt file. 5. After configuration, the analyzer will run in your pipeline. 6. View the results in the Vulnerability report and remediate the vulnerabilities.