ZAP Authentication script with redirect 302

[Phùng Quang Trường]

I'm writing authentication script. The app flow is:
- login form post method:

- response with set-cookie, and redirect to next 2 GET request with cookie

- from the last get request's response, get session key from response body

How can I follow redirect request to get the session key value ? 

[psiinon]

Have you tried the Authentication Tester?

If it works then it will make your life much easier!

https://www.zaproxy.org/docs/authentication/auto-detection/

Cheers,

Simon

--
You received this message because you are subscribed to the Google Groups "ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/1ee43dbd-7fe9-4bd9-887c-cdaa8f5f29d6n%40googlegroups.com.

--

ZAP Project leader

[Phùng Quang Trường]

It is an API with no GUI so I have to write it to authen manually

[psiinon]

Fair enough :)

How are you making the request?

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/8e1ebe09-b10c-488d-a09f-9c4dc6744c75n%40googlegroups.com.

--

ZAP Project leader

[Phùng Quang Trường]

What I'm doing now is after send POST request, I got the response code 302 and Location header. I continue use this Location as URL for the next request after that I got code 200 is when I know the redirect stops.  Is that redirect suppose to work like that in ZAP script?

[Simon Bennetts]

Can you share the code you are using to make the POST request.

You can replace any sensitive information like URLs.

[Phùng Quang Trường]

This is my code to authentication. And this is authentication flow that I use Postman to send login request

[Simon Bennetts]

Use "helper.sendAndReceive(msg, true);"

The second parameter is "followRedirect":

https://javadoc.io/static/org.zaproxy/zap/2.13.0/org/zaproxy/zap/authentication/AuthenticationHelper.html#sendAndReceive(org.parosproxy.paros.network.HttpMessage,boolean)

Cheers,

Simon

[Phùng Quang Trường]

Yaha, I got. It works like a charm. Thankyou sir.

[Simon Bennetts]

Thanks for letting us know!