Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Interpreting path info in "strict transport security not enforced" issues

A | Last updated: Jun 18, 2019 12:45PM UTC

Hi, In "target"->"site map"->"Issues" tab, I sometimes see reported issues labelled "Strict transport security not enforced" with a path set to "/", but when the request is shown, the path is actually something else. e.g. in the "issues" panel: ! Strict Transport Security not enforced [1] --! / --! /api/ --! /api/getObjects when clicking on the first issue (path = "/"), the request tab then shows: GET /api/somethingElseNotIntheOriginalList HTTP/1.1 ... How should I interpret this? Is this a bug or...? Regards, a.f.

PortSwigger Agent | Last updated: Jun 18, 2019 01:04PM UTC

Strict Transport Security issues generally affect a whole server, so Burp reports them once at the root, rather that reporting every single instance. The request you see is the very first request that Burp observed without the header.

Burp User | Last updated: Jun 21, 2019 12:20PM UTC

Thank you!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.