Perform ZAP scans with an authenticated session

[mogul]

At a glance

In order to ensure we are finding vulnerabilities only visible to authenticated users
as a FAC compliance-focused person
I want OWASP ZAP scans to be run in an authenticated session

Acceptance Criteria

We use DRY behavior-driven development wherever possible.

Scenario:

Given
when
...

then...

Beta Give feedback

1. this happens

Shepherd

• Design shepherd:
• Engineering shepherd:

Background

Security Considerations

Required per CM-4.

Sketch

Check out this example of how to do it

Tasks

Beta Give feedback

1. a thing we will need to handle

---

Process checklist

Sketch

• Design designs all the things
• Engineering engineers all the things

Definition of Done

Triage

If not likely to be important in the next quarter...

• Archived from the board

Otherwise...

• Has a clear story statement
• Design or Engineering accepts that it belongs in their respective backlog

Design Backlog

• Has clearly stated/testable acceptance criteria
• Meets the design Definition of Ready [citation needed]
• A design shepherd has been identified

Design In Progress

• Meets the design Definition of Done [citation needed]

Design Review Needed

• Necessary outside review/sign-off was provided

Design Done

• Presented in a sprint review
• Includes screenshots or references to artifacts

If no engineering is necessary

• Tagged with the sprint where it was finished
• Archived

Engineering Backlog

• Has clearly stated/testable acceptance criteria
• Has a sketch or list of tasks
• Can reasonably be done in a few days (otherwise, split this up!)

Engineering Available

• There's capacity in the In Progress column
• An engineering shepherd has been identified

Engineering In Progress

• Meets acceptance criteria
• Meets QASP conditions

If there's UI...

• Screen reader - Listen to the experience with a screen reader extension, ensure the information presented in order
• Keyboard navigation - Run through acceptance criteria with keyboard tabs, ensure it works.
• Text scaling - Adjust viewport to 1280 pixels wide and zoom to 200%, ensure everything renders as expected. Document 400% zoom issues with USWDS if appropriate.

Engineering Blocked

• Blocker removed/resolved

Engineering Review Needed

• Outside review/sign-off was provided

Engineering Done

• Presented in a sprint review
• Includes screenshots or references to artifacts
• Tagged with the sprint where it was finished
• Archived

[danswick]

@asteel-gsa is this okay to close?

[asteel-gsa]

@asteel-gsa is this okay to close?

I am, not really sure what this is if I am honest. I believe so.