zaproxy / zaproxy/zaproxy

Web App does not redirect in ZAP browser

Open
#8,448 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

Describe the bug

I have a web app whose URL is https://portal.smartlox.io/nyckel/ when you open this in regular browser it redirects to the login page after few seconds, but this is not happening in ZAP browser (tested both on Chrome and Firefox). Plus I have tested this in Burp browser as well and its working fine there too.

Steps to reproduce the behavior

Open https://portal.smartlox.io/nyckel/ in ZAP browser

Expected behavior

It should redirect without any issue

Software versions

ZAP
Version: 2.14.0

Installed Add-ons: [[id=accessControl, version=10.0.0],
[id=alertFilters, version=20.0.0], [id=ascanrules,
version=65.0.0], [id=authhelper, version=0.12.0],
[id=automation, version=0.38.0], [id=bruteforce,
version=15.0.0], [id=callhome, version=0.11.0],
[id=commonlib, version=1.24.0], [id=custompayloads,
version=0.13.0], [id=database, version=0.3.0], [id=diff,
version=14.0.0], [id=directorylistv1, version=7.0.0],
[id=domxss, version=18.0.0], [id=encoder, version=1.4.0],
[id=exim, version=0.8.0], [id=formhandler, version=6.5.0],
[id=fuzz, version=13.12.0], [id=gettingStarted,
version=16.0.0], [id=graaljs, version=0.6.0], [id=graphql,
version=0.23.0], [id=help, version=17.0.0], [id=hud,
version=0.18.0], [id=invoke, version=14.0.0], [id=network,
version=0.15.0], [id=oast, version=0.17.0], [id=onlineMenu,
version=12.0.0], [id=openapi, version=39.0.0], [id=postman,
version=0.3.0], [id=pscanrules, version=57.0.0],
[id=quickstart, version=45.0.0], [id=replacer,
version=16.0.0], [id=reports, version=0.31.0],
[id=requester, version=7.5.0], [id=retest, version=0.8.0],
[id=retire, version=0.34.0], [id=reveal, version=7.0.0],
[id=scripts, version=45.2.0], [id=selenium,
version=15.21.0], [id=soap, version=22.0.0], [id=spider,
version=0.10.0], [id=spiderAjax, version=23.18.0], [id=tips,
version=12.0.0], [id=wappalyzer, version=21.34.0],
[id=webdrivermacos, version=79.0.0], [id=websocket,
version=30.0.0], [id=zest, version=44.0.0]]

Operating System: Mac OS X
Architecture: aarch64
Java Version: Eclipse Adoptium 11.0.20.1
System's Locale: en_PK
Display Locale: en_GB
Format Locale: en_PK
Default Charset: UTF-8
ZAP Home Directory: /Users/administrator/Library/Application Support/ZAP/
ZAP Installation Directory: /Applications/ZAP.app/Contents/Java/./
Look and Feel: Mac OS X (com.apple.laf.AquaLookAndFeel)

Screenshots

No response

Errors from the zap.log file

No response

Additional context

No response

Would you like to help fix this issue?
  • Yes

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the redirect failure in the ZAP browser with ZAP 2.14.0 using the portal.smartlox.io/nyckel/ URL, then compare behavior with regular Chrome, Firefox, and Burp browser. Check the ZAP browser and proxy behavior around the delayed login redirect; done means the URL reaches the login page as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.