Difference in performance in Windows and Docker - ZAP Automation framework

[Madhuvanthi V]

Hi Team,

I am facing an issue with authentication when running the ZAP Automation Framework inside a docker container (Ubuntu), and I wanted to check if I might be missing something.

Background:

My application requires authentication. I initially performed a manual explore using the ZAP Desktop application and then created an Automation Framework plan from that session. When I run the scan directly from the ZAP Desktop application, authentication works correctly and the scan is able to access the authenticated areas of the application.

I then exported the Automation Framework plan and executed it locally on my Windows machine (outside the ZAP desktop session) using the following command:

zap.bat -cmd -autorun automation.yaml

In this scenario, everything works as expected. Authentication succeeds, and the spider discovers more than 200 URLs, including the authenticated pages.

Docker Execution:

Next, I moved the same automation.yaml file to my Ubuntu WSL environment, where I am running Docker, and executed the scan using the ZAP Docker image:
sudo docker run --user root --rm -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap.sh -cmd -autorun /zap/wrk/automation.yaml 

In the docker execution, automation plan suceeds but authentication does not appear to work correctly. The spider discovers only around 30 URLs, and the authenticated pages are missing from the results.

Additional Information

• The same automation.yaml file is used in both environments.

• Authentication method used: Form-based

Something else interesting that I found was, when executing the automation file in Windows terminal, authentication works only when I explictly mention browserId: edge-headless (fails with firefox headless) in type: spiderAjax block. I understand that docker image doesnt contain edge-headless so I replaced it with firefox-headless and auth still fails. 

Is there something I could do about this? Any suggestions or guidance would be greatly appreciated.

TIA,
Madhu

[Sai Mahidhar]

Hi there,

Zap uses zap user to run. You have launched using root hence it didn't work.

Just remove --user root, it will work or add --user zap.

--
ZAP by Checkmarx: https://www.zaproxy.org/
---
You received this message because you are subscribed to the Google Groups "ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/zaproxy-users/f6ad141d-f0a0-416b-a629-db56139ab2cfn%40googlegroups.com.

[Madhuvanthi V]

Hi,

Thanks for the response! 

I tried it that way, its still the same. 

Job spiderAjax started
Job spiderAjax found 0 URLs

....

Job spider found 36 URLs

[Madhuvanthi V]

Hi,

It is working now. I forgot to add " " to certain fields :)

Thanks for the response, it helped.

Best,

Madhu