how to add anti CSRF token via restful api in ZAP?

[Tauhidul Islam]

To add anti CSRF token, I am using  http://zap/JSON/acsrf/other/genForm/?hrefId="token"  restful API , but getting following error message:

{"code":"bad_format","message":"Bad Format","detail":"hrefId"}

any clue?

[Simon Bennetts]

Hi Tauhidul,

That operation is for generating a form for testing for CSRF vulnerabilities, and takes an integer as an argument. I realise we need to document the API calls better ;)

The API doesnt currently support adding anti CSRF tokens, but it shouldnt be difficult to do - I'll try and do that before we release ZAP 2.0!

Cheers,

Simon

[Simon Bennetts]

Yes, it was pretty straight-forward - committed as http://code.google.com/p/zaproxy/issues/detail?id=469

Cheers,

Simon

[Tauhidul Islam]

Hi Simon,

Cool! Hopefully will get the feature in the next weekly dev build :)
Thanks again!