## Overview As part of on-demand scans, users can run an API scan through a web interface. The On-demand process uses the OnDemand yaml file, https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Security/DAST-On-Demand-Scan.gitlab-ci.yml. Since the API Security tool is almost ready to roll out as the default API scanner, the template above should be updated to use the API Security DAST scanner instead of the zap engine. ## Implementation In order to switch over, a few frontend changes need to be put in place. This [design issue](https://gitlab.com/gitlab-org/gitlab/-/issues/348725) details the changes. * [:art:. Figma file](https://www.figma.com/file/o6NoqgLnxv0KnK2y9Qum51/DAST-Configuration-UI?node-id=1014%3A31065) * [:desktop: Prototype](https://www.figma.com/proto/o6NoqgLnxv0KnK2y9Qum51/DAST-Configuration-UI?page-id=1014%3A30234&node-id=1014%3A44808&viewport=429%2C48%2C0.99&scaling=min-zoom&starting-point-node-id=1014%3A44808) Both frontend and backend work will need to be done in order to make the switch. * Change "Rest API" to "API" * Change Target URL to "API Endpoint URL" * Add radio button for "Perform testing using:" OpenAPI, HAR, Postman * *Only 1 of the 3 path fields would show up depending on the status of the radio button* * Add Input field for HAR File Path \[ \] * Add Input field for OpenAPI File Path or URL \[ \] * Add Input field for Postman File Path \[ \] * Change excluded URLS to Excluded Paths In addition, passive and active attack profiles will need to be built for the API Security engine. The on-demand web interface encrypts and encodes sensitive variables. The following code will need to be added to the API Security engine, https://gitlab.com/gitlab-org/security-products/dast/-/merge_requests/418, to ensure it can read environment variables properly. ### Implementation plan | Task # | Issue | Description | Department | | ------ | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ------------------ | | 1 | https://gitlab.com/gitlab-org/gitlab/-/issues/327070 | Change DAST On-demand API Scanning Engine | gitlab~2492649 | | 2 | https://gitlab.com/gitlab-org/gitlab/-/issues/350735 | Frontend changes for API Security | gitlab~3412464 | | 3 | https://gitlab.com/gitlab-org/gitlab/-/issues/352625 | Documentation related updates | gitlab~2278655 | | 4 | https://gitlab.com/gitlab-org/gitlab/-/issues/345837 | Feature flag rollout | gitlab~7884237 | ## Decisions ### Feature Flag All related changes should be released with `dast_api_scanner` feature flag ### GraphQL #### `DastSiteProfileCreateInput` & `dastSiteProfileUpdateInput` The `DastSiteProfileCreateInput` and `dastSiteProfileUpdateInput` GraphQL types need to be extended to support the new scan method option. * `scanMethod` - `Type::ScanMethodEnum` * `scanFilePath` - `Type::String` `ScanMethodEnum` is a new Enum to identify the scan method to be used for the API Scan. The values for the enum are - `OPENAPI` - `POSTMAN_COLLECTION` - `HAR` #### `dastSiteProfiles` Query ```diff project(fullPath: $fullPath) { dastSiteProfiles(...) { nodes { id profileName normalizedTargetUrl targetUrl targetType + scanMethod + scanFilePath } } } ```