Intercepting requests does not intercept automatic authentication requests
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 15.8k
- Forks
- 2.6k
- Avg merge
- 13h 16m
- Merged PRs (30d)
- 17
Description
What steps will reproduce the problem?
- Choose a test site. For this example, I'll use WebGoat
- Create a context with an automatic Authentication method, for example Form-based Authentication
- Configure the Authentication method
- Use the User Forced Mode to send authentication request when needed
- Click on the "Set break on all requests and responses" button
What is the expected output? What do you see instead?
When authentication is needed, the authentication request is sent (it's shown in the history tab). However, the ZAP request interceptor can't intercept this request.
When authenticating manually (directly through the web browser), the authentication request is well intercepted by the ZAP interceptor.
Maybe it's a wanted/normal/conception-resulting behavior. However, I think it can be useful to be able to break every single request coming from or passing through ZAP.
What version of the product are you using?
2.4.3
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the WebGoat scenario using automatic Form-based Authentication, User Forced Mode, and the “Set break on all requests and responses” option. Compare the automatic authentication request with a browser-originated authentication request in the history and interceptor, then make completion mean that both request paths can be intercepted consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100