zaproxy / zaproxy/zaproxy

Easier default access to API through docker ZAP

Open
#5,216 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Docker enhancement
Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

Is your feature request related to a problem? Please describe.
The default API "Address permitted to use the API" access control rules in docker ZAP are too restrictive.

Describe the solution you'd like
Open up the default rules since docker assumes this security role through port forwarding rules.
Add an additional rule that allows connections from the docker gateway IP address by default, or
Replace all rules with a single enabled "*." regex.

Describe alternatives you've considered
Manually adjusting these rules every time I spin up a new docker instance, or
Possibly using a command line argument to add the rule to zap each time I spin up a new docker instance.

Additional context
This is my limited understanding of Docker works, I am probably wrong, but just in case: The only address the API "Addresses permitted to use the API" filter will ever see is traffic from the docker gateway IP address because docker port forwarding is the only means to connect with anything listening on the docker instance and docker "NAT's" that traffic. The other filter rules would only apply for things executing within the docker instance itself, so they're probably redundant here.

I think this issue may be related to https://github.com/zaproxy/zaproxy/issues/4485

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the Docker configuration for ZAP's API address-permission defaults and the related issue #4485. Verify which source address reaches the API through Docker port forwarding, then define and test the desired default rule behavior for a new Docker instance.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, java
Domain
api, infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.