ZAP Testing API endpoint which returns 403 by default

[Jakub Zilinek]

Hi,
We have an api endpoint like /api/foo, which requires auth, we would like to test the JWT Token.

We would like to use https://www.zaproxy.org/blog/2020-09-03-zap-jwt-scanner/.

But I cant start the JWT fuzz without the first request successing with HTTP 200. 

Any idea how to test that ?

Thank you :)

[Simon Bennetts]

Hiya,

Have you tried authenticating first, and then running the JWT fuzz on the endpoint which will hopefully have now returned a 200?

Cheers,

Simon