Include Bearer token in ZAP Scanning

[Baljit Singh]

Hello,

I'm working on a python script that helps extract the JWT Token after login.Once that part is done, every scan request made by ZAP should use the Authentication header with the Bearer token. 

However, I'm not able to figure out how to set the token for the current session. I've looked into contexts and authentication but I wasn't able to find the right way to do it.

Any help on this will be appreciated.

Thank you!

[Simon Bennetts]

Hiya,

Does you app have a login screen?

If so have you tried the ZAP Authentication Tester?

https://www.zaproxy.org/docs/authentication/

Cheers,

Simon

[Baljit Singh]

We don't use a login/password authentication.

The script that I have uses a custom token that is used to generate a Bearer token. This Bearer token is what should be injected into every request made by ZAP

[Simon Bennetts]

As long as your python script runs in ZAP you can just get it to set a Global Variable: https://www.zaproxy.org/docs/desktop/addons/script-console/#global-variables

You can check this variable in an httpsender script and then set that for every request.

Does that help?

Cheers,

Simon