zaproxy / zaproxy/zaproxy

Intercepting requests does not intercept automatic authentication requests

Open
#2,554 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

What steps will reproduce the problem?
  1. Choose a test site. For this example, I'll use WebGoat
  2. Create a context with an automatic Authentication method, for example Form-based Authentication
  3. Configure the Authentication method
  4. Use the User Forced Mode to send authentication request when needed
  5. Click on the "Set break on all requests and responses" button
What is the expected output? What do you see instead?

When authentication is needed, the authentication request is sent (it's shown in the history tab). However, the ZAP request interceptor can't intercept this request.
When authenticating manually (directly through the web browser), the authentication request is well intercepted by the ZAP interceptor.
Maybe it's a wanted/normal/conception-resulting behavior. However, I think it can be useful to be able to break every single request coming from or passing through ZAP.

What version of the product are you using?

2.4.3

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the WebGoat scenario using automatic Form-based Authentication, User Forced Mode, and the “Set break on all requests and responses” option. Compare the automatic authentication request with a browser-originated authentication request in the history and interceptor, then make completion mean that both request paths can be intercepted consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.