testland/zap-baseline

Configures and runs OWASP ZAP baseline scanning: `zap-baseline.py` Docker-packaged spider + passive scan suitable for CI gating; supports `-t target_url` + `-r html_report` + `-c config_file` rule customization (INFO/IGNORE/FAIL warnings) and Ajax spider via `-j` for JS-heavy SPAs; `zap-full-scan.py` active companion for staging. Covers authenticated scans end to end as a reference - ZAP Context, auth methods (form/JSON/script/browser), session management, verification strategy, OAuth/bearer injection, context XML export for `-n` - plus DAST cadence planning (PR-blocking passive baseline, nightly ZAP full + nuclei active layer, baseline-finding ratchet for legacy apps). Use when the user runs OWASP ZAP for pre-prod web app DAST, needs coverage of routes behind a login wall, or is designing a team's DAST rollout cadence.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

ZAP Authentication Verification Strategy

Per zap-verify, ZAP uses an Authentication Verification Strategy to know whether a request is executing as an authenticated user. Configure in Session Properties > Context > Authentication > Verification:

Logged-In Indicator: a regex present in responses when the user is authenticated. Examples:

\QWelcome, \E (welcome banner with the username)
\Qhref="/logout"\E (logout link in nav)
\Q"role":"user"\E (JSON response field)

Logged-Out Indicator: a regex present in responses when the session has expired. Examples:

\QPlease log in\E
\Qlocation: /login\E (redirect header)
HTTP/1\.1 401

Per zap-verify, four strategies are available:

Strategy	Use when
Check Every Response	Traditional HTML apps (indicator in page body)
Check Every Request	Client-side sessions (JWT in `Authorization` header)
Check Every Request or Response	Mixed; SPA + API combo
Poll the Specified URL	Dedicated `/api/me` or `/session/check` endpoint

Calibration steps:

Browse the app manually through ZAP proxy while logged in.
Right-click a response in the History tab that contains the logged-in text. Choose Flag as Context > <context-name> Logged in indicator. ZAP extracts the regex automatically.
Browse to a page after logging out. Right-click that response. Choose Flag as Context > <context-name> Logged out indicator.
Confirm both indicators in Session Properties > Context > Authentication.