Auth header data in open api scan - how to add

[Kanchan Kumar Jha]

Hello Everyone. 

Need help with this usecase. we have enabled few open API in our product. now need to scan using zap (UI/CLI anything) 

the authentication details goes as part of header as username/password with basic auth, how do we parse this in zap?

"import open api definition from ... " doesnt have provision for auth headers.

thanks.

-Kanchan

[thc...@gmail.com]

Hi.

Authentication is defined separately:
https://www.zaproxy.org/docs/desktop/start/features/authentication/

For your use case "Authentication Header Environmental Variables" might
be the easiest.

Best regards.

[Kanchan Kumar Jha]

found the solution. we can use replacer:

https://www.zaproxy.org/blog/2017-06-19-scanning-apis-with-zap/

  -config replacer.full_list\\(0\\).description=auth1 \   -config replacer.full_list\\(0\\).enabled=true \   -config replacer.full_list\\(0\\).matchtype=REQ_HEADER \   -config replacer.full_list\\(0\\).matchstr=Authorization \   -config replacer.full_list\\(0\\).regex=false \   -config replacer.full_list\\(0\\).replacement=123456789 \

 
the replacement value should be BASE10 of user and password. can be taken from Postman api.