Question Regarding Access Control Scan – 302 Redirect Instead of 403
Hiển Vũ Ngọc
I hope this message finds you well.
I'm currently using the Access Control Testing add-on in OWASP ZAP, and I have a question regarding the expected behavior of HTTP responses during access rule validation.
In my test setup, I’ve configured certain routes to be denied for specific roles (e.g., student). However, when scanning, the application returns a 302 redirect instead of a 403 Forbidden, even though the route is effectively inaccessible. This causes some confusion in interpreting the results.
I would like to ask:
-
Does the Access Control Testing add-on treat a 302 redirect as a valid “denied” response, or should the application explicitly return a 403 status code for denied access to be correctly identified?
-
In cases where the user is technically not authorized to access a page, but the server returns a redirect (e.g., to a login or home page), how does ZAP interpret that behavior during rule evaluation?
-
Is there a way to configure ZAP to recognize certain redirects as “access denied” conditions (e.g., by analyzing the Location header or response body)?
Any clarification or guidance on how to properly configure this behavior would be greatly appreciated.
Thank you very much for your support.
Best regards,
