My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I Zap forms-based authentication for a scenario like this? Is it doable?

  • Have you managed to make it work? Commented Dec 15, 2022 at 9:12

3 Answers 3


You can also try script-based authentication as the first measure: record an auth script in Zap UI (from the point where you login to the website), click Run when you are done recording to check if it actually logs in. If it does, profit.


Maybe you can achieve that integrating ZAP with testing/automation tools. Check out this:


For scanning microservices with token based authentication, the workaround is very different. If you need assistance with something like that, I could give you a more detailed solution.


There is a way to do this, it's too long to write as a comment but I will send a link to a blog post that I wrote two year ago.

Go to the section Setting up an active scan where I've written out the steps involved to scan a page with authentication. You may be able to do both, as long as the steps are followed but you have the same cookie/s?

Alternatively there is a owasp zaproxy user guide on Google which have been helpful.

  • The original link is not working, can you update it please? Commented Dec 15, 2022 at 9:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .