Form-based Authentication bug

I have tried to test our company's site using Form-based Authentication, but it did not work.

As I investigated in history tab on Tags "Authentication, sometimes its method is GET, sometimes POST.
Seems ZAP use the method of the last request which is the same as Form-based Authentication address.

It will work fine if method is POST.

I guess the problem is the link to log in, log out, and home using the same address but different method and parameters.

i.e. (addresses are just examples)

log in request :
method => POST
address => www.example.com
param => username=user&password=pass&login=yes

log out request :
method => POST
address => www.example.com
param => logout=yes

home request :
method => GET
address => www.example.com
param =>

I have tested again with these steps.

Case 1 :

1. log in manually (method POST)
2. set the request as Form-based Authentication(include setting user/pass and forced user)
3. log out (method POST)
4. enable forced user
5. refresh page (home request). the result is that it does log in automatically (Success)
6. Tags Authentication in history tab is method POST.

Case 2 :

1. log in manually (method POST)
2. set the request as Form-based Authentication(include setting user/pass and forced user)
3. log out (method POST)
4. *** refresh the page first (home request - method GET)
5. enable forced user
6. refresh page (home request). the result is that it does not log in automatically (Fail)
7. Tags Authentication in history tab is method GET.
8. It is always fail if I do GET request before ZAP use Form-based Authentication.

With this problem, I cannot use Active scan, spider, and AJAX spider completely because sometimes it's fail on Form-based Authentication step. So it always redirect to log-in page.

ref : https://groups.google.com/d/msg/zaproxy-users/Ea4NYVDYjjQ/I1PdTaIfSUoJ

Start by reproducing the two Form-based Authentication cases described in the issue, using requests with the same URL but different GET and POST methods. Done means authentication remains successful after a GET request and Active scan, spider, and AJAX spider do not redirect to the login page.