path: root/data/removals/14_0/remove_dast_spider_host_reset.yml

- name: "Default DAST spider begins crawling at target URL"
  removal_date: "2021-06-22"
  removal_milestone: "14.0"
  reporter: derekferguson
  breaking_change: true
  body: |
    In GitLab 14.0, DAST has removed the current method of resetting the scan to the hostname when starting to spider. Prior to GitLab 14.0, the spider would not begin at the specified target path for the URL but would instead reset the URL to begin crawling at the host root. GitLab 14.0 changes the default for the new variable `DAST_SPIDER_START_AT_HOST` to `false` to better support users' intention of beginning spidering and scanning at the specified target URL, rather than the host root URL. This change has an added benefit: scans can take less time, if the specified path does not contain links to the entire site. This enables easier scanning of smaller sections of an application, rather than crawling the entire app during every scan.