The rule would raise info alerts for each script it found along with the integrety hash, as per
https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

This could just work on URLs that are in scope - it would just be useful when you're trying to create a CSP for a specific site.

Apache 部署GVA

部署版本

GVA 2.4.0

具体配置

VirtualHost 配置中加入:

    <Proxy /api>  
         Order deny,allow  
         Allow from all  
     </Proxy>  
     ProxyPass /api http://127.0.0.1:8888      
     ProxyPassReverse /api http://127.0.0.1:8888

此配置目的与 官方 nginx 提供配置类似。

注意

Apache 需要开启 proxy_module

http://127.0.0.1:8888 为后端默认地址，如已更改记得替换

If HTTP sites (is not HTTPS ones) use the Access-Control-Allow-Origin header then the site will typically not work.
ZAP should automatically fix this header.
https://stackoverflow.com/questions/61940616/how-do-i-work-with-http-sites-using-the-hud-in-owasps-zap-proxy