doc/user/application_security/dast/profiles.md
{{< details >}}
{{< /details >}}
DAST site and scanner profiles save information related to your applications and the scanners you use to evaluate them. Once you define a profile, you can use it for pipeline and on-demand DAST jobs.
The creation, updating, and deletion of DAST profiles, DAST scanner profiles, and DAST site profiles are included in the audit log.
{{< history >}}
{{< /history >}}
A site profile defines the attributes and configuration details of the deployed application, website, or API to be scanned by DAST.
A site profile contains:
.gitlab-ci.yml or an on-demand scan, it cannot be renamed.?) character, because it is a valid URL character.id or name of the element that when selected submits the sign-in HTML form.When an API site type is selected, a host override is used to ensure the API being scanned is on the same host as the target. This is done to reduce the risk of running an active scan against the wrong API.
When configured, request headers and password fields are encrypted using aes-256-gcm before being stored in the database.
This data can only be read and decrypted with a valid secrets file.
You can reference a site profile in .gitlab-ci.yml and
on-demand scans.
stages:
- dast
include:
- template: DAST.gitlab-ci.yml
dast:
stage: dast
dast_configuration:
site_profile: "<profile name>"
Site profile validation reduces the risk of running an active scan against the wrong website. You must validate a site to run an on-demand scan against it.
Site profile validation is not a security feature. If necessary, you can run DAST against an unvalidated site with a pipeline scan.
Each of the site validation methods are equivalent in functionality, so use whichever is most suitable:
Gitlab-On-Demand-DAST be added to the target site,
with a value unique to the project. The validation process checks that the header is present, and
checks its value.gitlab-dast-validation be added to the
target site, with a value unique to the project. Make sure it's added to the <head> section of
the page. The validation process checks that the meta tag is present, and checks its value.To create a site profile:
The site profile is saved, for use in an on-demand scan.
Edit a site profile to change its settings before a scan.
If a site profile is linked to a security policy, you cannot edit the profile from this page. See scan execution policies for more information.
To activate the site validation pipeline, you must define a runner with the tag dast-validation-runner or define a runner that can run untagged jobs.
Prerequisites:
To edit a site profile:
If a site profile's target or authenticated URL is updated, the request headers and password fields associated with that profile are cleared.
[!note] If a site profile is linked to a security policy, a user cannot delete the profile from this page. See Scan execution policies for more information. If a site profile is linked to an on-demand scan and is deleted, the on-demand scan is also deleted.
To delete a site profile:
Validating a site is required to run an active scan.
Prerequisites:
To validate a site profile:
The site is validated and an active scan can run against it. A site profile's validation status is revoked only when it's revoked manually, or its file, header, or meta tag is edited.
Failed site validation attempts are listed on the Site profiles tab of the Manage profiles page.
To retry a site profile's failed validation:
[!warning] When a site profile's validation status is revoked, all site profiles that share the same URL also have their validation status revoked.
To revoke a site profile's validation status:
The site profile's validation status is revoked.
The following are code samples of how you can provide the required site profile header in your application.
Here's how you can add a custom header in a Ruby on Rails application:
class DastWebsiteTargetController < ActionController::Base
def dast_website_target
response.headers['Gitlab-On-Demand-DAST'] = '0dd79c9a-7b29-4e26-a815-eaaf53fcab1c'
head :ok
end
end
Here's how you can add a custom header in Django:
class DastWebsiteTargetView(View):
def head(self, *args, **kwargs):
response = HttpResponse()
response['Gitlab-On-Demand-DAST'] = '0dd79c9a-7b29-4e26-a815-eaaf53fcab1c'
return response
Here's how you can add a custom header in Node (with Express):
app.get('/dast-website-target', function(req, res) {
res.append('Gitlab-On-Demand-DAST', '0dd79c9a-7b29-4e26-a815-eaaf53fcab1c')
res.send('Respond to DAST ping')
})
{{< history >}}
{{< /history >}}
A scanner profile defines the configuration details of a security scanner.
A scanner profile contains:
.gitlab-ci.yml or an on-demand scan, it cannot be renamed.You can reference a scanner profile in .gitlab-ci.yml and
on-demand scans.
stages:
- dast
include:
- template: DAST.gitlab-ci.yml
dast:
stage: dast
dast_configuration:
scanner_profile: "<profile name>"
To create a scanner profile:
Prerequisites:
[!note] If a scanner profile is linked to a security policy, you cannot edit the profile from this page. For more information, see Scan execution policies.
To edit a scanner profile:
[!note] If a scanner profile is linked to a security policy, a user cannot delete the profile from this page. For more information, see Scan execution policies. If a scanner profile is linked to an on-demand scan and is deleted, the on-demand scan is also deleted.
To delete a scanner profile: