-
-
Notifications
You must be signed in to change notification settings - Fork 136
HelpUiDialogsSessionContext auth
This is one of the Session Context screens which allows you to manage the way in which Authentication is being done for the Context. After selecting the Authentication Method type, the options that need to be configured depend on the Authentication Method.
Note: Changing the authentication method after Users have been defined might cause its credentials to be reset, as the type of user credentials need to match the authentication scheme. A confirmation dialogue will be shown when that happens.
No configuration is needed for this authentication method. Read more...
To configure this authentication method, you need to supply the login url, to which the login request is performed, the request body (POST data), if needed, and identify the parameters used to supply the 'username' and 'password'. If no request body is supplied, the login request is performed as a HTTP GET, otherwise an HTTP POST is used. The credentials themselves are configured in the Users tab. Read more...
To configure this authentication method, you need to supply the login url, to which the login request is performed, the JSON object (POST data, application/json
), and identify the parameters used to supply the 'username' and 'password'. The credentials themselves are configured in the Users tab. Read more...
Examples of POST data:
{"username":"{%username%}","password":"{%password%}"}
{"user":{"mail":"{%username%}","password":"{%password%}"}}
where {%username%}
and {%password%}
indicate where the authentication credentials are set.
To configure this authentication method, you need to supply the hostname and the port of the server the authentication is done with and the realm the credentials apply to. The credentials themselves are configured in the Users tab. Read more...
To use this authentication method, you first need to write (and save) an Authentication Script using the Scripts tab (see the provided examples and templates for this script type in the Scripts tab). Then you need to supply the name of the script in the dropdown list. After selecting the script, you need to press the Load button, loading all the requirements of the script. Any parameters that you have specified as required or optional in the script will be shown in the interface to be defined. Their values are available to be used in the script, during the authentication, as seen in the provided examples for Authentication Scripts. Make sure that after doing any changes to the parameters required by the Authentication script you re-load the script. Otherwise, the parameters shown in the interface might not be the ones used during the authentication and errors might occur. The credentials used for each User during the authentication processed can be also specified in the Authentication Script and are configured in the Users tab. Read more...
Top level File menu | 'Properties...' menu item |
UI Overview | for an overview of the user interface | |
Dialogs | for details of the dialogs or popups | |
Session Context screens | for details of the other Context screens | |
Authentication | for an overview of Authentication |
-
ZAP User Guide
- Introduction
-
Getting Started
- Configuring proxies
-
Features
- Active Scan
- Add-ons
- Alerts
- Anti CSRF Tokens
- API
- Authentication
- Break Points
- Callbacks
- Contexts
- Data Driven Content
- Filters
- Globally Excluded URLs
- HTTP Sessions
- Man-in-the-middle Proxy
- Modes
- Notes
- Passive Scan
- Scan Policies
- Scope
- Session Management
- Spider
- Statistics
- Structural Modifiers
- Structural Parameters
- Tags
- Users
- Scanner Rules
- A Simple Penetration Test
-
The User Interface
- Overview
- The Top Level Menu
- The Top Level Toolbar
- The Tabs
-
The Dialogs
- Active Scan
- Add Alert
- Add Break Point
- Add Note
- Encode/Decode/Hash
- Filter
- Find
- History Filter
- Manual Request Editor
- Manage Add-ons
- Manage Tags
-
Options
- Active Scan
- Active Scan Input Vectors
- Alerts
- Anti CSRF Tokens
- API
- Breakpoints
- Callback Address
- Certificate
- Check for Updates
- Connection
- Database
- Display
- Dynamic SSL Certificates
- Extensions
- Global Exclude URL
- HTTP Sessions
- JVM
- Keyboard
- Language
- Local Proxies
- Passive Scan Rules
- Passive Scan Tags
- Passive Scanner
- Rule Configuration
- Scripts
- Search
- Spider
- Statistics
- Persist Session
- Resend
- Scan Policy Manager
- Scan Progress
- Session
- Spider
- The Footer
- Command Line
- Add Ons
- Releases
- Paros Proxy
- Credits