This is one of the Session Context screens which allows you to manage the way in which Authentication is being done for the Context.
After selecting the Authentication Method type, the options that need to be configured depend on the Authentication Method.
Note: Changing the authentication method after Users have been defined might cause its credentials to be reset, as the type of user credentials need to match the authentication scheme. A confirmation dialogue will be shown when that happens.
No configuration is needed for this authentication method. Read more…
To configure this authentication method, you need to supply the login url , to which the login request is performed, the request body (POST data), if needed, and identify the parameters used to supply the ‘username’ and ‘password’. If no request body is supplied, the login request is performed as a HTTP GET, otherwise an HTTP POST is used. The credentials themselves are configured in the Users tab. The login page can also be supplied to indicate from where to obtain a new session (e.g. cookies) and regenerate Anti CSRF tokens present in the request body . If the login page is not supplied it is used the login url .
Read more…
To configure this authentication method, you need to supply the login url , to which the login request is performed, the JSON object (POST data, application/json), and identify the parameters used to supply the ‘username’ and ‘password’. The credentials themselves are configured in the Users tab. The login page can also be supplied to indicate from where to obtain a new session (e.g. cookies). If the login page is not supplied it is used the login url .
Read more…
Examples of POST data:
{"username":"{%username%}","password":"{%password%}"}{"user":{"mail":"{%username%}","password":"{%password%}"}}where {%username%} and {%password%} indicate where the authentication credentials are set.
To configure this authentication method, you need to supply the hostname and the port of the server the authentication is done with and the realm the credentials apply to. The credentials themselves are configured in the Users tab. Read more…
To use this authentication method, you first need to write (and save) an Authentication Script using the Scripts tab (see the provided examples and templates for this script type in the Scripts tab). Then you need to supply the name of the script in the dropdown list. After selecting the script, you need to press the Load button, loading all the requirements of the script. Any parameters that you have specified as required or optional in the script will be shown in the interface to be defined. Their values are available to be used in the script, during the authentication, as seen in the provided examples for Authentication Scripts. Make sure that after doing any changes to the parameters required by the Authentication script you re-load the script. Otherwise, the parameters shown in the interface might not be the ones used during the authentication and errors might occur. The credentials used for each User during the authentication processed can be also specified in the Authentication Script and are configured in the Users tab. Read more…
Select the Authentication Verification Strategy required.
If this regex pattern is specified and matches any string in the specified message then ZAP will treat this message as logged in. For example the pattern could be used to match a http://example.com/logout link or the presence of a ‘Welcome, User X’ message.
If this regex pattern is specified and matches any string in the specified message then ZAP will treat this message as logged out. For example the pattern could be used to match a http://example.com/login link or the presence of a ‘Welcome, Guest’ message.
This controls how frequently ZAP will poll to see if a user is still authenticated. The integer will either represent the number of Requests that will be made before ZAP will poll again or the number of Seconds before it will poll again, depending on pulldown selected.
The option is only relevant if the “Poll the Specified URL” Verification Strategy has been selected.
This is the URL that ZAP will poll to see if a user is still authenticated.
The option is only relevant if the “Poll the Specified URL” Verification Strategy has been selected.
If supplied then this will be sent as a POST in the poll request. If it is empty then ZAP will make a GET request
The option is only relevant if the “Poll the Specified URL” Verification Strategy has been selected.
An optional set of headers that will be sent with the poll request. Each line should be one header and value separated by a colon e.g
Content-Type: application/json
X-Requested-With: XMLHttpRequest
The option is only relevant if the “Poll the Specified URL” Verification Strategy has been selected.
| Sites tab | Double click a Context |
| UI Overview | for an overview of the user interface | |
| Dialogs | for details of the dialogs or popups | |
| Session Context screens | for details of the other Context screens | |
| Authentication | for an overview of Authentication |