Security checks and pentests #169

New issue

Closed

opened 2026-08-20 11:33:16 +00:00 by aaperis · 0 comments

aaperis commented

2026-08-20 11:33:16 +00:00

(Migrated from github.com)

Please describe the task

As a developer, I want to test the security hardening of SDAD so that I can make sure that the webapp complies with security best practices.

Detailed description

Use a dedicated pentest-like tool to test the security of the webapp. Document/try to fix any findings (use confluence). A nice tool for the job is ZAP (this is now supported by the Software Security Project instead of OWASP but it is backed by the same core team).

Additionally:

Ensure that:
JWT not logged
cookie not printed by default
use credentials: include
cookies are httpOnly
access to dataset/file routes without valid session is prevented

## Please describe the task As a developer, I want to test the security hardening of SDAD so that I can make sure that the webapp complies with security best practices. ## Detailed description - [x] Use a dedicated pentest-like tool to test the security of the webapp. Document/try to fix any findings (use confluence). A nice tool for the job is [ZAP](https://www.zaproxy.org/) (this is now supported by the Software Security Project instead of OWASP but it is backed by the same core team). Additionally: - [x] Ensure that: - JWT not logged - cookie not printed by default - use credentials: include - cookies are httpOnly - access to dataset/file routes without valid session is prevented