Require explicit opt-in to bypass TLS validation during authentication #297

Summary

Consolidate the authentication hardening finding reported by both Copilot Code Review and GitHub Advanced Security on #296 into one tracking issue:

• Copilot Code Review finding
• Advanced Security finding

Both comments identify the same underlying problem at action.yml:130.

Problem and impact

The public ignore_https_errors input is described as allowing scans of URLs with self-signed certificates, but action.yml forwards it to both the Authenticate and Find steps. In .github/actions/auth/src/index.ts, that value enables Playwright's ignoreHTTPSErrors on the browser context used for HTTP Basic and form authentication.

As a result, enabling a scan-time exception also disables certificate validation for login_url, which may be on a different host. A user intending only to scan a self-signed target can unintentionally expose login credentials to an attacker intercepting the authentication connection. The risk requires the bypass to be enabled; authentication currently validates certificates by default.

Hardening scope

• Add a dedicated optional public input, auth_ignore_https_errors, with a default of 'false' and an explicit warning that enabling it disables certificate validation during credentialed authentication.
• Wire the Authenticate step's existing ignore_https_errors input exclusively to ${{ inputs.auth_ignore_https_errors }}. Do not inherit or fall back to the scan-level setting.
• Leave the Find step wired to ${{ inputs.ignore_https_errors }} so scan-time behavior remains unchanged.
• Update input documentation and examples, including a compatibility note: workflows that intentionally authenticate against self-signed endpoints must explicitly enable the new authentication input.

Acceptance criteria

• With ignore_https_errors: true and auth_ignore_https_errors omitted or false, authentication still validates the login endpoint's certificate, including when login and scan URLs use different hosts. An invalid certificate fails authentication rather than silently retrying insecurely.
• Setting auth_ignore_https_errors: true explicitly permits authentication against a self-signed endpoint, independently of the scan setting.
• Enabling only the authentication bypass does not disable certificate validation in Find; existing scan-only bypass behavior is preserved.
• Valid-certificate HTTP Basic and form authentication, unauthenticated scans, and supplied auth_context flows retain their existing behavior.
• Regression coverage verifies the composite action's input wiring, the secure authentication default, and all four combinations of the two flags, with both supported authentication mechanisms covered.
• Documentation explains the separate controls, credential-exposure risk, and migration for workflows relying on the previous coupling.

🤖 Assisted by Copilot