Adding a static token to ZAP vulnerability scanner

Question

I am currently trying to get the OWASP ZAP scanners working on a peculiar website.

When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter.

Otherwise, a 302 redirect to the disconnect page is sent back by the server. Is there a way to add this parameter to the ZAP scanners?

Answer 1

There will be a way to handle this, but it will all depend on the details. Does the token change? If so where can it be obtained from? ZAP supports scripts that can change anything in the requests and responses, but in this case you'll have to know where to get the required token from.