I am currently trying to get the OWASP ZAP scanners working on a peculiar website.

When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter.

Otherwise, a 302 redirect to the disconnect page is sent back by the server. Is there a way to add this parameter to the ZAP scanners?

1 Answer 1


There will be a way to handle this, but it will all depend on the details. Does the token change? If so where can it be obtained from? ZAP supports scripts that can change anything in the requests and responses, but in this case you'll have to know where to get the required token from.

  • One token is generated by the server for each session. It does not go away until the session is ended.
    – Keysuke
    Feb 21, 2019 at 10:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .