So I have recently been working on security testing with OWASP ZAP. However I have hit a road block in that I can't get the (ajax) spider to test within an authorized area of the single page application.
I have looked at the different options in session properties as described in the image below. However the authorization to my single page application involves sending a base64 encoded username and password as a header value which doesn't appear to be supported.
Ideally I need to either be able to simply specify the header values base64 string myself, or specify username and password and have the ZAP proxy just enter the fields, and submit them and let the web application encode and send them.
I was really just wondering if anyone has any good suggestions to get around this limitation? I saw the "Script-based Authentation", but was unable to import a script for it, and wasn't quite sure how it would work?