Remove domain validation from DAST
The domain validation in DAST is an opt-in in order to opt-out and therefore does not have very good use cases. The validation also conflicts with the approach of on-demand DAST scanning and introduces confusion.
In 14.0 we will remove this functionality.
Proposal
-
Remove the functionality -
Update documentation to eliminate the use, https://docs.gitlab.com/ee/user/application_security/dast/#domain-validation -
Issue deprecation notice.
Technical Details
Use config.dast_major_version
to ensure that the check and related argument definitions are not present when the DAST version >= 2.0