Easier default access to API through docker ZAP
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 15.8k
- Forks
- 2.6k
- Avg merge
- 13h 16m
- Merged PRs (30d)
- 17
Description
Is your feature request related to a problem? Please describe.
The default API "Address permitted to use the API" access control rules in docker ZAP are too restrictive.
Describe the solution you'd like
Open up the default rules since docker assumes this security role through port forwarding rules.
Add an additional rule that allows connections from the docker gateway IP address by default, or
Replace all rules with a single enabled "*." regex.
Describe alternatives you've considered
Manually adjusting these rules every time I spin up a new docker instance, or
Possibly using a command line argument to add the rule to zap each time I spin up a new docker instance.
Additional context
This is my limited understanding of Docker works, I am probably wrong, but just in case: The only address the API "Addresses permitted to use the API" filter will ever see is traffic from the docker gateway IP address because docker port forwarding is the only means to connect with anything listening on the docker instance and docker "NAT's" that traffic. The other filter rules would only apply for things executing within the docker instance itself, so they're probably redundant here.
I think this issue may be related to https://github.com/zaproxy/zaproxy/issues/4485
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the Docker configuration for ZAP's API address-permission defaults and the related issue #4485. Verify which source address reaches the API through Docker port forwarding, then define and test the desired default rule behavior for a new Docker instance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, java
- Domain
- api, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100