URLs missing from ZAP vs JuiceShop docs page

Describe the bug

There are URLs that can be observed when manually exploring OWASP JuiceShop in a browser that are not listed on https://www.zaproxy.org/docs/scans/juiceshop/

Steps to reproduce the behavior

1. Start OWASP JuiceShop
2. Open a browser proxied through OWASP ZAP
3. Browse around Juice Shop normally
4. Save entries found under http://localhost in sites tab to HAR and parse

Expected behavior

These are the URLs exported and parsed after a semi-comprehensive browse through unauthenticated and authenticated functionality. I have removed the URLS currently listed on the page. I would expect these to appear on https://www.zaproxy.org/docs/scans/juiceshop/

DELETE http://localhost/api/BasketItems/9
DELETE http://localhost/api/BasketItems/10
GET http://localhost/103.js
GET http://localhost/ae.svg
GET http://localhost/api/Addresss
GET http://localhost/api/Addresss/7
GET http://localhost/api/BasketItems/9
GET http://localhost/api/BasketItems/10
GET http://localhost/api/BasketItems/11
GET http://localhost/api/BasketItems/12
GET http://localhost/api/BasketItems/13
GET http://localhost/api/BasketItems/14
GET http://localhost/api/BasketItems/15
GET http://localhost/api/BasketItems/16
GET http://localhost/api/BasketItems/17
GET http://localhost/api/BasketItems/18
GET http://localhost/api/BasketItems/19
GET http://localhost/api/BasketItems/20
GET http://localhost/api/BasketItems/21
GET http://localhost/api/BasketItems/22
GET http://localhost/api/BasketItems/23
GET http://localhost/api/BasketItems/24
GET http://localhost/api/BasketItems/25
GET http://localhost/api/BasketItems/26
GET http://localhost/api/BasketItems/27
GET http://localhost/api/BasketItems/28
GET http://localhost/api/BasketItems/29
GET http://localhost/api/BasketItems/30
GET http://localhost/api/BasketItems/31
GET http://localhost/api/BasketItems/32
GET http://localhost/api/BasketItems/33
GET http://localhost/api/BasketItems/34
GET http://localhost/api/Cards
GET http://localhost/api/Cards/7
GET http://localhost/api/Deliverys
GET http://localhost/api/Deliverys/1
GET http://localhost/api/Feedbacks/
GET http://localhost/api/Products/1(d)
GET http://localhost/api/Products/2(d)
GET http://localhost/api/Products/3(d)
GET http://localhost/api/Products/4(d)
GET http://localhost/api/Products/5(d)
GET http://localhost/api/Products/6(d)
GET http://localhost/api/Products/7(d)
GET http://localhost/api/Products/8(d)
GET http://localhost/api/Products/9(d)
GET http://localhost/api/Products/13(d)
GET http://localhost/api/Products/14(d)
GET http://localhost/api/Products/15(d)
GET http://localhost/api/Products/16(d)
GET http://localhost/api/Products/17(d)
GET http://localhost/api/Products/18(d)
GET http://localhost/api/Products/19(d)
GET http://localhost/api/Products/20(d)
GET http://localhost/api/Products/21(d)
GET http://localhost/api/Products/22(d)
GET http://localhost/api/Products/23(d)
GET http://localhost/api/Products/24(d)
GET http://localhost/api/Products/25(d)
GET http://localhost/api/Products/26(d)
GET http://localhost/api/Products/29(d)
GET http://localhost/api/Products/30(d)
GET http://localhost/api/Products/32(d)
GET http://localhost/api/Products/33(d)
GET http://localhost/api/Products/35(d)
GET http://localhost/api/Products/41(d)
GET http://localhost/api/Products/42(d)
GET http://localhost/api/Products/43(d)
GET http://localhost/api/Recycles/
GET http://localhost/api/SecurityQuestions/
GET http://localhost/assets/i18n/ar_SA.json
GET http://localhost/assets/i18n/az_AZ.json
GET http://localhost/assets/i18n/bg_BG.json
GET http://localhost/assets/i18n/bn_BD.json
GET http://localhost/assets/i18n/ca_ES.json
GET http://localhost/assets/i18n/cs_CZ.json
GET http://localhost/assets/i18n/da_DK.json
GET http://localhost/assets/i18n/de_CH.json
GET http://localhost/assets/i18n/de_DE.json
GET http://localhost/assets/i18n/el_GR.json
GET http://localhost/assets/i18n/es_ES.json
GET http://localhost/assets/i18n/et_EE.json
GET http://localhost/assets/i18n/fi_FI.json
GET http://localhost/assets/i18n/fr_FR.json
GET http://localhost/assets/i18n/ga_IE.json
GET http://localhost/assets/i18n/he_IL.json
GET http://localhost/assets/i18n/hi_IN.json
GET http://localhost/assets/i18n/hu_HU.json
GET http://localhost/assets/i18n/id_ID.json
GET http://localhost/assets/i18n/it_IT.json
GET http://localhost/assets/i18n/ja_JP.json
GET http://localhost/assets/i18n/ka_GE.json
GET http://localhost/assets/i18n/ko_KR.json
GET http://localhost/assets/i18n/lv_LV.json
GET http://localhost/assets/i18n/my_MM.json
GET http://localhost/assets/i18n/nl_NL.json
GET http://localhost/assets/i18n/no_NO.json
GET http://localhost/assets/i18n/pl_PL.json
GET http://localhost/assets/i18n/pt_BR.json
GET http://localhost/assets/i18n/pt_PT.json
GET http://localhost/assets/i18n/ro_RO.json
GET http://localhost/assets/i18n/ru_RU.json
GET http://localhost/assets/i18n/si_LK.json
GET http://localhost/assets/i18n/sv_SE.json
GET http://localhost/assets/i18n/th_TH.json
GET http://localhost/assets/i18n/tr_TR.json
GET http://localhost/assets/i18n/uk_UA.json
GET http://localhost/assets/i18n/zh_CN.json
GET http://localhost/assets/i18n/zh_HK.json
GET http://localhost/assets/i18n/zh_TW.json
GET http://localhost/assets/public/css/userProfile.css
GET http://localhost/assets/public/images/carousel/1.jpg
GET http://localhost/assets/public/images/carousel/2.jpg
GET http://localhost/assets/public/images/carousel/3.jpg
GET http://localhost/assets/public/images/carousel/4.jpg
GET http://localhost/assets/public/images/carousel/5.png
GET http://localhost/assets/public/images/carousel/6.jpg
GET http://localhost/assets/public/images/carousel/7.jpg
GET http://localhost/assets/public/images/ChatbotAvatar.png
GET http://localhost/assets/public/images/deluxe/blankBoxes.png
GET http://localhost/assets/public/images/products/3d_keychain.jpg
GET http://localhost/assets/public/images/products/card_alpha.jpg
GET http://localhost/assets/public/images/products/coaster.jpg
GET http://localhost/assets/public/images/products/cover_small.jpg
GET http://localhost/assets/public/images/products/fan_girlie.jpg
GET http://localhost/assets/public/images/products/fan_hoodie.jpg
GET http://localhost/assets/public/images/products/fan_mug.jpg
GET http://localhost/assets/public/images/products/fan_shirt.jpg
GET http://localhost/assets/public/images/products/holo_sticker.png
GET http://localhost/assets/public/images/products/iron-on.jpg
GET http://localhost/assets/public/images/products/magnets.jpg
GET http://localhost/assets/public/images/products/no-results.png
GET http://localhost/assets/public/images/products/orange_juice.jpg
GET http://localhost/assets/public/images/products/quince.jpg
GET http://localhost/assets/public/images/products/raspberry_juice.jpg
GET http://localhost/assets/public/images/products/snakes_ladders.jpg
GET http://localhost/assets/public/images/products/snakes_ladders_m.jpg
GET http://localhost/assets/public/images/products/sticker_page.jpg
GET http://localhost/assets/public/images/products/sticker_single.jpg
GET http://localhost/assets/public/images/products/strawberry_juice.jpeg
GET http://localhost/assets/public/images/products/tattoo.jpg
GET http://localhost/assets/public/images/products/velcro-patch.jpg
GET http://localhost/assets/public/images/products/woodruff_syrup.jpg
GET http://localhost/assets/public/images/uploads/%F0%9F%98%BC-
GET http://localhost/assets/public/images/uploads/default.svg
GET http://localhost/assets/public/images/uploads/favorite-hiking-place.png
GET http://localhost/assets/public/images/uploads/IMG_4253.jpg
GET http://localhost/assets/public/images/uploads/magn(et)ificent!-1571814229653.jpg
GET http://localhost/assets/public/images/uploads/my-rare-collectors-item!-%5B%CC%B2%CC%85$%CC%B2%CC%85(%CC%B2%CC%85-%CD%A1%C2%B0-%CD%9C%CA%96-%CD%A1%C2%B0%CC%B2%CC%85)%CC%B2%CC%85$%CC%B2%CC%85%5D-1572603645543.jpg
GET http://localhost/az.svg
GET http://localhost/bg.svg
GET http://localhost/br.svg
GET http://localhost/ch.svg
GET http://localhost/cn.svg
GET http://localhost/cz.svg
GET http://localhost/de.svg
GET http://localhost/dk.svg
GET http://localhost/ee.svg
GET http://localhost/es-ct.svg
GET http://localhost/es.svg
GET http://localhost/favicon.ico
GET http://localhost/fi.svg
GET http://localhost/fr.svg
GET http://localhost/ftp/order_7069-a36f6eb527b6a646.pdf
GET http://localhost/gb.svg
GET http://localhost/ge.svg
GET http://localhost/gr.svg
GET http://localhost/hk.svg
GET http://localhost/hu.svg
GET http://localhost/id.svg
GET http://localhost/ie.svg
GET http://localhost/il.svg
GET http://localhost/in.svg
GET http://localhost/it.svg
GET http://localhost/jp.svg
GET http://localhost/kr.svg
GET http://localhost/lv.svg
GET http://localhost/mm.svg
GET http://localhost/nl.svg
GET http://localhost/no.svg
GET http://localhost/pl.svg
GET http://localhost/profile
GET http://localhost/pt.svg
GET http://localhost/rest/basket/6
GET http://localhost/rest/chatbot/status
GET http://localhost/rest/continue-code
GET http://localhost/rest/deluxe-membership
GET http://localhost/rest/order-history
GET http://localhost/rest/products/1/reviews
GET http://localhost/rest/products/2/reviews
GET http://localhost/rest/products/3/reviews
GET http://localhost/rest/products/4/reviews
GET http://localhost/rest/products/5/reviews
GET http://localhost/rest/products/6/reviews
GET http://localhost/rest/products/7/reviews
GET http://localhost/rest/products/8/reviews
GET http://localhost/rest/products/9/reviews
GET http://localhost/rest/products/13/reviews
GET http://localhost/rest/products/14/reviews
GET http://localhost/rest/products/15/reviews
GET http://localhost/rest/products/16/reviews
GET http://localhost/rest/products/17/reviews
GET http://localhost/rest/products/18/reviews
GET http://localhost/rest/products/19/reviews
GET http://localhost/rest/products/20/reviews
GET http://localhost/rest/products/21/reviews
GET http://localhost/rest/products/22/reviews
GET http://localhost/rest/products/23/reviews
GET http://localhost/rest/products/24/reviews
GET http://localhost/rest/products/25/reviews
GET http://localhost/rest/products/26/reviews
GET http://localhost/rest/products/29/reviews
GET http://localhost/rest/products/30/reviews
GET http://localhost/rest/products/32/reviews
GET http://localhost/rest/products/33/reviews
GET http://localhost/rest/products/34/reviews
GET http://localhost/rest/products/35/reviews
GET http://localhost/rest/products/36/reviews
GET http://localhost/rest/products/37/reviews
GET http://localhost/rest/products/38/reviews
GET http://localhost/rest/products/41/reviews
GET http://localhost/rest/products/42/reviews
GET http://localhost/rest/products/43/reviews
GET http://localhost/rest/products/search?q=
GET http://localhost/rest/track-order/7069-a36f6eb527b6a646
GET http://localhost/rest/user/security-question(email)
GET http://localhost/rest/wallet/balance
GET http://localhost/ro.svg
GET http://localhost/ru.svg
GET http://localhost/se.svg
GET http://localhost/si.svg
GET http://localhost/th.svg
GET http://localhost/tn.svg
GET http://localhost/tr.svg
GET http://localhost/tw.svg
GET http://localhost/ua.svg
GET http://localhost/us.svg
POST http://localhost/api/Addresss/
POST http://localhost/api/BasketItems/
POST http://localhost/api/Cards/
POST http://localhost/api/Complaints/
POST http://localhost/api/Feedbacks/
POST http://localhost/api/Recycles/
POST http://localhost/api/SecurityAnswers/
POST http://localhost/api/Users/
POST http://localhost/rest/basket/6/checkout
POST http://localhost/rest/chatbot/respond
POST http://localhost/rest/user/login
POST http://localhost/rest/user/reset-password
PUT http://localhost/api/Addresss/7
PUT http://localhost/api/BasketItems/9
PUT http://localhost/api/BasketItems/10
PUT http://localhost/api/BasketItems/11
PUT http://localhost/api/BasketItems/12
PUT http://localhost/api/BasketItems/13
PUT http://localhost/api/BasketItems/14
PUT http://localhost/api/BasketItems/15
PUT http://localhost/api/BasketItems/16
PUT http://localhost/api/BasketItems/17
PUT http://localhost/api/BasketItems/18
PUT http://localhost/api/BasketItems/19
PUT http://localhost/api/BasketItems/20
PUT http://localhost/api/BasketItems/21
PUT http://localhost/api/BasketItems/22
PUT http://localhost/api/BasketItems/23
PUT http://localhost/api/BasketItems/24
PUT http://localhost/api/BasketItems/25
PUT http://localhost/api/BasketItems/26
PUT http://localhost/api/BasketItems/27
PUT http://localhost/api/BasketItems/28
PUT http://localhost/api/BasketItems/29
PUT http://localhost/api/BasketItems/30
PUT http://localhost/api/BasketItems/31
PUT http://localhost/api/BasketItems/32
PUT http://localhost/api/BasketItems/33
PUT http://localhost/api/BasketItems/34
PUT http://localhost/rest/basket/6/coupon/COUPON_PLS
PUT http://localhost/rest/products/6/reviews

Software versions

OWASP JuiceShop v15.0.0 (https://hub.docker.com/layers/bkimminich/juice-shop/v15.0.0/images/sha256-163482fed1f8e7c8558cc476a512b13768a8d2f7a04b8aab407ab02987c42382)

Screenshots

No response

Errors from the zap.log file

No response

Additional context

The list I have provided is an example.

A more comprehensive manual crawl would need to be done to find the true full list of URLs, I expect mine is still a subset. In particular I believe more could be discovered by exploring different permutations of flows, especially around forms.

Would you like to help fix this issue?

• Yes

Open the ZAP JuiceShop documentation page named in the issue and compare its current URL list with the supplied HAR-derived entries. Reproduce the browse-through-ZAP workflow against OWASP JuiceShop to verify which entries are missing and relevant, then update the page so the agreed URL coverage is present.