Add a request parameter in every request made

[Leonardo Oliveira]

Hi,

I need to test an application in which every requested page needs to have a request parameter caled "t" with an authentication token.

Example:

- To access the xyz resource, I need to make the request below:

https://app/api/xyz?t=abcdef

how do I make to add the "t" request parameter in all the requests performed by ZAP, including the scanners and the spider?

[Simon Bennetts]

The easiest way to change requests is using the replacer: https://www.zaproxy.org/docs/desktop/addons/replacer/

However this case is a little bit tricky, as you probably want to do different things depending on whether the URL already has parameters, e.g.

• https://app/api/xyz -> https://app/api/xyz?t=abcdef
• https://app/api/xyz?x=yz -> https://app/api/xyz?x=yz&t=abcdef

So in this case I'd recommend using an httpsender script - we have lots of example scripts here: https://github.com/zaproxy/community-scripts/tree/main/httpsender

Cheers,

Simon