testland/zap-authenticated-scans

Configures authenticated DAST sessions in ZAP - ZAP Context + Authentication Method (form, JSON, script, browser-based, HTTP/NTLM), Session Management strategy (cookie, header, script), Verification Strategy (regex indicators, poll-URL), CSRF token handling, OAuth/bearer header injection, logged-in/logged-out indicator calibration, and context XML export for use with `-n` in baseline and full scans. Use when the team needs DAST coverage of authenticated routes - the most common DAST gap and the hardest DAST setup to get right.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

ZAP Authentication Verification Strategy

Name: testland/zap-authenticated-scans
Rating: 74.4 (1 reviews)
Author: testland

Per zap-verify, ZAP uses an Authentication Verification Strategy to know whether a request is executing as an authenticated user. Configure in Session Properties > Context > Authentication > Verification:

Logged-In Indicator: a regex present in responses when the user is authenticated. Examples:

\QWelcome, \E (welcome banner with the username)
\Qhref="/logout"\E (logout link in nav)
\Q"role":"user"\E (JSON response field)

Logged-Out Indicator: a regex present in responses when the session has expired. Examples:

\QPlease log in\E
\Qlocation: /login\E (redirect header)
HTTP/1\.1 401

Per zap-verify, four strategies are available:

Strategy	Use when
Check Every Response	Traditional HTML apps (indicator in page body)
Check Every Request	Client-side sessions (JWT in `Authorization` header)
Check Every Request or Response	Mixed; SPA + API combo
Poll the Specified URL	Dedicated `/api/me` or `/session/check` endpoint

Calibration steps:

Browse the app manually through ZAP proxy while logged in.
Right-click a response in the History tab that contains the logged-in text. Choose Flag as Context > <context-name> Logged in indicator. ZAP extracts the regex automatically.
Browse to a page after logging out. Right-click that response. Choose Flag as Context > <context-name> Logged out indicator.
Confirm both indicators in Session Properties > Context > Authentication.