You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<p>We probably do not have access to your app, and even if we did we would not have the time to understand it for you.</p>
151
151
<p>This means that you need to understand exactly how your app handles authentication (and session handling) in order to configure ZAP to handle it for you.</p>
<p>See the FAQ: <ahref="/faq/why-cant-zap-connect-to-my-website/">Why can’t ZAP connect to my web application?</a></p>
166
+
167
+
<h4id="failure-to-fill-in-the-login-form">Failure to Fill in the Login Form <aclass="header-link" href="#failure-to-fill-in-the-login-form"><svgclass="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><pathd="M0 0h24v24H0z" fill="none"/><pathd="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h4>
168
+
<p>Watch the browser when it is launched from the Authentication Tester, or check the screenshots in the Authentication Report.</p>
169
+
<p>If you do not see the correct login form then try to find and configure the correct URL.</p>
170
+
<p>If there is not a fixed URL you can use then select a fixed URL that has a link to the login URL.</p>
171
+
<p>If the application is using anti-automation features like CAPTCHAs or OTPs then you should disable them.</p>
172
+
<p>You can configure ZAP to handle TOTP but it will complicate your setup.</p>
173
+
<p>If you need to fill in more information than just username and password then you should record a client side script. This can be done from within the Authentication Tester.</p>
174
+
<p>If the recording fails then open the login page in a browser and check to see if the HTML element that the recording fails on is present. The failing element should be specified in the error message.</p>
175
+
<p>If your app generates different IDs each time the login form is generated then you
176
+
will either need to change your app to make it more automation friendly, or hand craft a Zest client side script to cope with them. XPath expressions may work more effectively that IDs.</p>
<p>Watch the browser when it is launched from the Authentication Tester, or check the screenshots in the Authentication Report.</p>
180
+
<p>If the app does not fully load then increase the “Time to Wait” until you can see that it has fully loaded.</p>
181
+
<p>Have a look at the domains in the Sites Tree. If there are any that you know are part of your app (such as APIs) or which could be related to authentication then add these domains in the Authentication Tester: Domains tab.</p>
182
+
<p>If you are using the Authentication Tester then keep an eye on the passive scan threads in the <ahref="/docs/desktop/ui/footer/">footer</a>.
183
+
If there are still passive scan threads running when the browser is closed then the passive scan rules which
184
+
detect the session and verification details may not have run.</p>
185
+
<p>You can try disabling all of the passive scan rules except for the following ones:</p>
<p>If you still see failures then get in touch with us via the <ahref="https://groups.google.com/group/zaproxy-users">User Group</a> so that we can keep improving ZAP.</p>
192
+
<p>You can also try to configure them manually:</p>
"summary": "\u003cp\u003eIf you ask a question related to authentication on one of the ZAP forums then you will be directed here.\u003c/p\u003e\n\u003cp\u003eWe know that the ZAP authentication documentation needs improving.\nOne of the reasons why it has not been improved is that we are too busy trying to answer authentication questions \u0026#x1f609;.\u003c/p\u003e",
5968
-
"content": "you ask question related authentication one zap forums then will directed here we know that documentation needs improving reasons why has not been improved too busy trying answer questions x1f609 currently focusing docs which means have much time answering specific redirected x1f604 understand your app hard would love able program automatically all forms long way off probably do access even did need exactly how handles session handling order configure handle existing resources there lot can help you: working official videos search auth tags field user group similar more recent answers likely relevant developer per please dont post topics addingchanging code addons having said some historic threads may assist faq: authenticate via note diagnosing problems section applies most "
5968
+
"content": "you ask question related authentication one zap forums then will directed here we know that documentation needs improving reasons why has not been improved too busy trying answer questions x1f609 currently focusing docs which means have much time answering specific redirected x1f604 understand your app hard would love able program automatically all forms long way off probably do access even did need exactly how handles session handling order configure handle use tester makes significantly easier most applications login shows what worked failed generates context can testing any reason cannot desktop browserauthtestyaml automation framework plan report either analyse yourself import into via auth diags tab common problems failure see faq: cant connect my web application fill form watch browser when launched from check screenshots correct try find url there fixed select link using antiautomation features like captchas otps should disable them totp complicate setup more information than just username password record client side script done within recording fails open page html element present failing specified error message different ids each generated change make friendly hand craft zest cope xpath expressions may work effectively identify verification does fully load increase wait until loaded look domains sites tree part such apis could add these tester: keep eye passive scan threads footer still running closed rules detect details run disabling except following ones: request identified management failures get touch us user group also manually: finding other resources lot help you: working official videos search tags field similar recent answers likely relevant developer per please dont post topics addingchanging code addons having said some historic assist authenticate note diagnosing section applies "
0 commit comments