Can we filter status code in the Alters?

[sunny shi]

Hi,

Can I use the status code to filter the alter? For instance, I want to filter all alters that the response is 401.

[Simon Bennetts]

Not via alert filters.

But I can see why that would be useful - raise an feature request for it?

https://github.com/zaproxy/zaproxy/issues/new?assignees=&labels=enhancement&projects=&template=feature-request.yml

As an alternative you could write a script which listend for alerts being raise, and then deletes them if the status code is a 401.

You could use this script as the basis for that: https://github.com/zaproxy/community-scripts/blob/main/extender/ZAP%20onEvent%20Handler.js

Cheers,

Simon

[sunny shi]

Thanks for your support. We want to filter them to mark them as false positives. Sometimes one alter has more than 200 URLs and we need to check it individually. It's a huge workload.

[kingthorin+zap]

You could do something like this: https://github.com/zaproxy/zaproxy/issues/1603#issuecomment-447031828

You'd just have to change the conditionals, but it'd work.

[kingthorin+zap]

Other options here: https://www.zaproxy.org/faq/how-do-i-handle-a-false-positive/

[sunny shi]

Ok, thanks.