GET Web Application Security Evidence: Sensitive Data Exposure

https://api.bitsighttech.com/ratings/v1/companies/company_guid/findings?risk_vector=web_appsec

Get sensitive data exposure evidence, including:

• Cookie SameSite Attribute
• Cookie SameSite Blocked
• HSTS Preload Directive Present
• Mixed Content
• Secure Cookie Set on Insecure Channel
• Session Token in URL
• Unsafe Referrer Policy

For details specific to Web Application Security, use the ?risk_vector=web_appsec parameter. Other query parameters are listed in GET: Finding Details.

Cookie SameSite Attribute

[assessmentName = cookie_same_site_attribute]

Example Response

{
  "name": "TS0...b0b",
  "message": "Cookie does not have the SameSite attribute",
  "value": "017aab903c93f57f8079...2ba5a47e3e6799c7f53c",
  "attributes": "TS0...b0b=017aab903c93f57f8079...2ba5a47e3e6799c7f53c; Path=/; Domain=url; Secure",

  ⊕ See additional evidences

}

Response Attributes

name

message

value

attributes

Cookie SameSite Blocked

[assessmentName = cookie_same_site_blocked]

Example Response

{
  "name": "ENTRY_KEY",
  "message": "A cookie was blocked due to SameSite policy violation for reason EXCLUDE_SAME_SITE_UNSPECIFIED_TREATED_AS_LAX",
  "resolution": "blocked",
  "attributes": "path=/; domain=url",
  "resourceUrl": "url",

  ⊕ See additional evidences

}

Response Attributes

name

message

resolution

attributes

resourceUrl

HSTS Preload Directive Present

[assessmentName = hsts_preload_present]

Example Response

{
  "header": "Strict-Transport-Security",
  "value": "max-age=63072000; includeSubDomains; preload",

  ⊕ See additional evidences

}

Response Attributes

header

value

Mixed Content

[assessmentName = mixed_content]

Example Response

{
  "type": "IMAGE",
  "resolution": "upgraded",
  "resource": "url",
  "details": "Mixed Content: The page at 'url' was loaded over HTTPS, but requested an insecure element 'url'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html",

  ⊕ See additional evidences

}

Response Attributes

type

resolution

resource

details

Secure Cookie Set on Insecure Channel

[assessmentName = secure_cookie_on_insecure_channel]

Example Response

{
  "name": "GUEST_LANGUAGE_ID",

  ⊕ See additional evidences

}

Response Attributes

name

Session Token in URL

[assessmentName = session_token_in_url]

Example Response

{
  "name": "id",
  "value": "0987654321",
  "resource": "url",

  ⊕ See additional evidences

}

Response Attributes

name

value

resource

Unsafe Referrer Policy

[assessmentName = unsafe_referrer_policy]

Example Response

{
  "header": "Referrer-Policy",
  "value": "unsafe-url",

  ⊕ See additional evidences

}

Response Attributes

header

value