Did Not Connect: Potential Security Issue

[Steven Atkinson]

I'm new to ZAP, and the ZAP HUD.

I think because my site uses these response headers the HUD is DOA:

X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff

I get big black security warnings instead of the HUD sidebar menus.

Anyone else encountered this>

Steve

[Simon Bennetts]

Hi Steve,

Yeah, that will probably break the HUD.

We already remove CSP so we should do the same for "X-Frame-Options: DENY" as well - I've raised a new issue for this: https://github.com/zaproxy/zap-hud/issues/999

In the meantime you can do this yourself with Replacer rule: https://www.zaproxy.org/docs/desktop/addons/replacer/

Try that and see if it works for you - let us know either way.

Cheers,

Simon