Client Script Based Auth (WIP)

Signed-off-by: kingthorin <[email protected]>
zaproxy · Jan 24, 2025 · d02f036 · d02f036
1 parent 1845b96
commit d02f036
Show file tree

Hide file tree

Showing 11 changed files with 1,029 additions and 21 deletions.
diff --git a/addOns/authhelper/CHANGELOG.md b/addOns/authhelper/CHANGELOG.md
@@ -7,6 +7,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ### Changed
 - Ignore non-displayed fields when selecting the user name and password.
 
+### Added
+- Added support for Client Script Authentication when used in conjunction with the Ajax Spider add-on.
+
 ## [0.17.0] - 2025-01-09
 ### Changed
 - Update minimum ZAP version to 2.16.0.

diff --git a/addOns/authhelper/authhelper.gradle.kts b/addOns/authhelper/authhelper.gradle.kts
@@ -17,7 +17,7 @@ zapAddOn {
                 dependencies {
                     addOns {
                         register("spiderAjax") {
-                            version.set(">=23.15.0")
+                            version.set(">=23.23.0")
                         }
                     }
                 }
@@ -29,7 +29,13 @@ zapAddOn {
                 dependencies {
                     addOns {
                         register("client") {
-                            version.set(">=0.10.0")
+                            version.set(">=0.11.0")
+                        }
+                        register("scripts") {
+                            version.set(">=45.8.0")
+                        }
+                        register("zest") {
+                            version.set(">=48.1.0")
                         }
                     }
                 }
@@ -69,6 +75,7 @@ dependencies {
     zapAddOn("selenium")
     zapAddOn("spiderAjax")
     zapAddOn("client")
+    zapAddOn("zest")
 
     testImplementation(project(":testutils"))
 }
diff --git a/addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/AuthUtils.java b/addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/AuthUtils.java
@@ -591,7 +591,8 @@ static SessionManagementRequestDetails findSessionTokenSource(String token) {
         return findSessionTokenSource(token, -1);
     }
 
-    static SessionManagementRequestDetails findSessionTokenSource(String token, int firstId) {
+    public static SessionManagementRequestDetails findSessionTokenSource(
+            String token, int firstId) {
         ExtensionHistory extHist = AuthUtils.getExtension(ExtensionHistory.class);
         int lastId = extHist.getLastHistoryId();
         if (firstId == -1) {