Skip to content

Update documentation for On Demand Scan

Update documentation for On Demand Scans to indicate usage of Browser Based Scanner and availability in FIPS mode

https://docs.gitlab.com/ee/user/application_security/dast/proxy-based.html#on-demand-scans

Requirements

  1. Separate the On Demand DAST docs parallel to "DAST browser-based analyzer" and "DAST proxy-based analyzer".
    1. The On Demand DAST page should also carry over the documentation for site profile and scanner profile.
    2. Remove references to AJAX Spider from the Scanner Profile documentation
  2. Update the description of the DAST Modes as both refer to the ZAP Proxy.

Implementation Plan

  • Create a new file in https://docs.gitlab.com/ee/user/application_security/dast/ named `on-demand_scan".
  • Move the content of the "On-demand scans", "Site profile" and "Scanner profile" sections from the https://docs.gitlab.com/ee/user/application_security/dast/proxy-based.html page, into the file created in the step above.
  • Remove all instances of ZAP, including "ZAP Baseline Scan" and "ZAP Full Scan". In the introduction of the new on-demand docs page, we should mention briefly that the browser-based DAST analyzer is used. Perhaps include a mention in a version note that the ZAP method is deprecated.
  • Review the technical content of the new page, updating anything as required, now that on-demand DAST scans use the browser-based analyzer.

Related Epic: &11429 (closed)

Edited by Arpit Gogia