Zest is unable to handle token generation through the java script

[sandeep p]

While I was doing zest scripting to generate a token through java script, I need to get a new token for every request that has been coming from client side. But ZEST is unable to handle it. Is there any solution for us to update the script or integrate zest with java script.

Thanks,

Sandeep.

[Simon Bennetts]

Hi Sandeep,

Details always matter, especially in cases like this.

What is the app doing?

What is your script doing?

Why do you think Zest is unable to handle it?

Right now we have nothing to go on.

Cheers,

Simon

[sandeep p]

Hi Simon,

Thanks for the replay, Please find the scenario below.

We have sequence of 5 requests for the login to be completed and somewhere in the 3rd request a unique token_id is being sent in the request, but this unique token_id is not being received in any of the previous responses, it is being generated on client side at the runtime randomly using java script. This is what we want to be incorporated into the script, so that the 3rd request will also be successful, then the following login sequence is completed.

Example:
Request 1
Request 2
Request 3-->having a unique token_id(parameter), this unique token is generated using some java script code.
Request 4
Request 5


Thanks,

Sandeep

[Simon Bennetts]

Hi Sandeep,

If the token is generated client side then you will need to launch a browser to make the client side request.

Zest can do that.

You may need another httpsender script in order to extract the token, but without more details its difficult to say.

Example requests and responses would help...

Cheers,

Simon

[sandeep p]

Hi Simon,

Application in discussion uses dot net and angular java script.

Within the angular JS, we have a code that generates a unique “token_id” on the client side by taking a few inputs dynamically.

Sample Code Snippet:

c=this.loginUrl+a+"parameter1="+encodeURIComponent(b)+"&parameter2="+encodeURIComponent(d)+"&token_id="+encodeURIComponent(e)+"&parameter3="+encodeURIComponent(i)+"& parameter4="+encodeURIComponent(l);

Our scenario: assume we have below pages and files in my application.
1.    login.aspx
2.    Main.js

3.    Dashboard.aspx

After entering the credentials in” login.aspx” page, the application is generating a unique token_id by using “main.js” file to access the “dashboard.aspx” page. Can you help us how this JS can be integrated with Zest script.

Thanks,

Sandeep.

[sandeep p]

Hi Simon,

Is the provided information sufficient for you to help us.

Thanks,

Sandeep.

[sandeep p]

Hi Simon,

While I was doing zest scripting to generate a token through java script, I need to get a new token for every request that has been coming from client side. But ZEST is unable to handle it.

Let’s assume.
We have sequence of 3 requests for the login to be completed and somewhere in the 2nd request (main.js) and it’s generating a unique token_id by using below mentioned sample Java script code snippet, this unique token_id is not being received in any of the previous responses. This is what we want to be incorporated into the script, by using this unique token_id we can access “Users Dashboard.aspx”.

Application uses dot net and angular java script.

below pages and files in my application.
1.    login.aspx

2.    Main.js (mentioned below sample code snippet)
3.    User dashboard.aspx

Sample Code Snippet:
c=this.loginUrl+a+"parameter1="+encodeURIComponent(b)+"&parameter2="+encodeURIComponent(d)+"&token_id="+encodeURIComponent(e)+"&parameter3="+encodeURIComponent(i)+"& parameter4="+encodeURIComponent(l);

Can you help us how this JS can be integrated with Zest script.

Thanks,

Sandeep.

[Simon Bennetts]

Hi Sandeep,

Lets see if I understand this.

Your app constructs a token on the client for every request using the above javascript, and if that token is not valid then the backend rejects it?

Is that right?

Cheers,

Simon

[sandeep p]

Hi Simon.

Yes, your understanding is correct. Can you please help us in this situation.

Thanks,

Sandeep.

[Simon Bennetts]

Honestly, it sounds like you've made your life really difficult for yourselves without making your service any more secure.

Ideally you should go back and rewrite it in a more sane way!

Failing that, your only realistic option is to implement the same logic in a ZAP httpsender script written in javascript.

Good luck!

Simon

[sandeep p]

Hi Simon,

Thanks for the response.

Any future plans to getting this kind of feature.

Thank You,

Sandeep.

[Simon Bennetts]

Theres nothing for us to do - ZAP already supports the necessary scripting, as far as I'm aware.

You just need to write the scripts...