authhelper: try login links if authentication fails WIP #6203
+371
−4
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Great job, no security vulnerabilities found in this Pull Request |
kingthorin
reviewed
Feb 19, 2025
addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/AuthUtils.java
Outdated
Show resolved
Hide resolved
kingthorin
reviewed
Feb 19, 2025
addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/AuthUtils.java
Outdated
Show resolved
Hide resolved
|
Should we have a list of fields/buttons to avoid or exclude? Like: reset, forgot etc (To ensure we aren't hitting a PW reset form) |
Yes, but that would be for the AJAX/client spiders. This code will only click on Login type links, which should not have any logout / reset terms? If they could be present then we could avoid them, but I dont know of any examples right now. |
psiinon
force-pushed
the
authhelper/loginlinks
branch
3 times, most recently
from
c6dc362 to
812fb86
Compare
psiinon
changed the title
Signed-off-by: Simon Bennetts <[email protected]>
psiinon
force-pushed
the
authhelper/loginlinks
branch
from
812fb86 to
70b17e0
Compare
kingthorin
reviewed
Feb 21, 2025
| @@ -4,6 +4,9 @@ All notable changes to this add-on will be documented in this file. | |||
| The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). | |||
|
|
|||
| ## Unreleased | |||
| ### Added | |||
| - If authentication fails then try to find a likely looking login link | |||
psiinon
changed the title
|
Moved back to WIP as its not working with some of the real world sites I'm testing with |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
As per title.
Ready for review but would like the auth tests in place before its merged so we can see what impact it has.
Related Issues
Checklist
./gradlew spotlessApplyfor code formattingFor more details, please refer to the developer rules and guidelines.