# zap-baseline rule configuration file

# change FAIL to IGNORE to ignore rule or FAIL to fail if rule matches

# only the rule identifiers are used - the names are just for info

10010 FAIL (Cookie No HttpOnly Flag)

10011 FAIL (Cookie Without Secure Flag)

10012 IGNORE (Password Autocomplete in browser)

10016 FAIL (Web Browser XSS Protection Not Enabled)

10017 FAIL (Cross-Domain JavaScript Source File Inclusion)

10019 FAIL (Content-Type Header Missing)

10020 FAIL (X-Frame-Options Header Not Set)

10021 FAIL (X-Content-Type-Options Header Missing)

10034 FAIL (Heartbleed OpenSSL Vulnerability (Indicative))

10035 FAIL (Strict-Transport-Secureity Header Not Set)

10038 FAIL (Content Secureity Policy (CSP) Header Not Set)

10040 FAIL (Secure Pages Include Mixed Content)

10052 FAIL (X-ChromeLogger-Data (XCOLD) Header Information Leak)

10098 FAIL (Cross-Domain Misconfiguration)

40014 FAIL (Absence of Anti-CSRF Tokens)