Authentication (Cognito/NextAuth) simulation via session/cookie

[Maxb_dev]

Hi, 

I'm trying to found how i can make the ZAP to log my user in based on Cognito login (it have MFA) so i thought about extracting the cookie session from another browser login page but i don't found how to achieve that.

Basically my app login flow is :
/login -> cognito redirection (Username+password +MFA) -> redirect back on my app with nextauth and set session/cookie. 

Currently i'm stuck finding a way to achieve that authentication with the ZAP tools. 

If anyone done that and can assist. 

Thanks

[Simon Bennetts]

Hiya,

For anything related to authentication see https://www.zaproxy.org/docs/authentication/

ZAP can handle TOTP fields, but we do recommend that you try to make your life easier :)

Cheers,

Simon

[Maxb_dev]

Thanks, 

i'll give it a try without MFA. 

But can ZAP handle a redirection authentication to cognito and set username/password on another site than the requested page site initially ?

Best regards,

[Simon Bennetts]

Yes :)

See https://www.zaproxy.org/blog/2025-07-03-authentication-improvements/