Questions regarding the AJAXSpider & OpenAPI jobs

[Alexis N.]

Hello everyone,

I’ve been doing some tests with the Automation Framework in ZAP Desktop. While running my automation plan, I noticed that the AJAX Spider was filling in every form in my application. Isn’t that a strange behavior? If I’m not mistaken, the AJAX Spider should only interact with JavaScript and not try to inject anything. I haven’t configured any active scans in my automation plan, so I was quite surprised by this behavior. If anyone can explain why this happens, that would be very helpful! :)

Also, has anyone already performed an OpenAPI scan while authenticated? It doesn’t seem to work well on my side, and I’d be very interested in learning how it works. I’ve checked the ZAP chat series and read the documentation, but I’m still struggling, unfortunately.

Thanks in advance for your answers and your help !

Best Regards,

Alexis