testland/zap-baseline
Use when a web app needs OWASP ZAP scanning before production: the Docker baseline passive scan as a CI gate, the full active scan for staging, the Ajax spider for SPAs, scans behind a login (forms, JSON, OAuth or bearer tokens) and a rollout plan from PR baseline to nightly active scans.
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
verification-strategy.mdreferences/
ZAP Authentication Verification Strategy
Per zap-verify, ZAP uses an Authentication Verification Strategy to know
whether a request is executing as an authenticated user. Configure in
Session Properties > Context > Authentication > Verification:
Logged-In Indicator: a regex present in responses when the user is authenticated. Examples:
\QWelcome, \E(welcome banner with the username)\Qhref="/logout"\E(logout link in nav)\Q"role":"user"\E(JSON response field)
Logged-Out Indicator: a regex present in responses when the session has expired. Examples:
\QPlease log in\E\Qlocation: /login\E(redirect header)HTTP/1\.1 401
Per zap-verify, four strategies are available:
| Strategy | Use when |
|---|---|
| Check Every Response | Traditional HTML apps (indicator in page body) |
| Check Every Request | Client-side sessions (JWT in Authorization header) |
| Check Every Request or Response | Mixed; SPA + API combo |
| Poll the Specified URL | Dedicated /api/me or /session/check endpoint |
Calibration steps:
- Browse the app manually through ZAP proxy while logged in.
- Right-click a response in the History tab that contains the logged-in
text. Choose
Flag as Context > <context-name> Logged in indicator. ZAP extracts the regex automatically. - Browse to a page after logging out. Right-click that response. Choose
Flag as Context > <context-name> Logged out indicator. - Confirm both indicators in
Session Properties > Context > Authentication.