I need some help with setting up OWASP ZAP to correctly crawl my One-page Angular website with the spider.
I successfully set up a zscript which will handle the login and add a HTTP Session I can set as active.
However my website has a special need to add an
auth-id to the header additionally to the
JSESSION-ID. However the spider won't do it automatically, so I need help with configurating it correctly.
The header which works looks like this:
GET http://localhost:8180/rest/crud/jobDefinition HTTP/1.1 Host: localhost:8180 Proxy-Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Accept: application/json, text/plain, */* auth-id: 1015 auth-token: 2b84722e-3270-483d-8852-e319b8c12810 Referer: http://localhost:8180/ Accept-Encoding: gzip, deflate, br Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: JSESSIONID=7evOfQDs5F0bXcsmSq0rIM3U6AYQ1-PoD9L4HRb3.FG003.server01; pi_side_menu_size=large; authToken=2b84722e-3270-483d-8852-e319b8c12810
the only header content my spider in ZAP is sending is this:
GET http://localhost:8180/rest/permission/ HTTP/1.1 Pragma: no-cache Cache-Control: no-cache Content-Length: 0 Cookie: JSESSIONID=D1L17-8UQ4CpAeJ4NC40txHP3YPHWG8e6dyep-Js.FG003.server01 Host: localhost:8180
The script to login is loaded into my session context and when I start the spider it should either find my active marked session and use that one or perform the login over the script.
Checking forced user mode didn't change anything, also I cant find the configuration to let my spider to use these header variables.
Is it even possible or can I only use a passive scan?