How do you run an authenticated ZAP scan in CI against a login-protected app?
⚡
Quick Answer
The scanner must hold a session or it only ever tests the login page.
Detailed Answer
The scanner must hold a session or it only ever tests the login page. Script authentication (form login, or inject a bearer token/session cookie), define logged-in/logged-out indicators so ZAP notices when the session drops, exclude logout URLs so it does not sign itself out, and seed the spider with the API/OpenAPI definition so it reaches endpoints the crawler would miss.
Code Example
# Deep-dive: OWASP ZAP # baseline vs full scans, spidering and AJAX spidering, authenticated scans with session tokens, the API scan for OpenAPI specs, taming scan duration in CI, and interpreting alerts by risk and confidence # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
💡
Interview Tip
This is where depth shows — be concrete about OWASP ZAP, not generic about "security".
zapdevsecopsdeep-dive