src/scripts/templates/authentication/Simple Form-Based Authentication.js
function authenticate(helper, paramsValues, credentials) {
	print("Authenticating via JavaScript script...");

	// Make sure any Java classes used explicitly are imported
	var HttpRequestHeader = Java.type("org.parosproxy.paros.network.HttpRequestHeader")
	var HttpHeader = Java.type("org.parosproxy.paros.network.HttpHeader")
	var URI = Java.type("org.apache.commons.httpclient.URI")

	// Prepare the login request details
	var requestUri = new URI(paramsValues.get("Target URL"), false);
	var requestMethod = HttpRequestHeader.POST;
	
	// Build the request body using the credentials values
	var extraPostData = paramsValues.get("Extra POST data");
	var requestBody = paramsValues.get("Username field") + "=" + encodeURIComponent(credentials.getParam("Username"));
	requestBody+= "&" + paramsValues.get("Password field") + "=" + encodeURIComponent(credentials.getParam("Password"));
	if(extraPostData.trim().length() > 0)
		requestBody += "&" + extraPostData.trim();

	// Build the actual message to be sent
	print("Sending " + requestMethod + " request to " + requestUri + " with body: " + requestBody);
	var msg = helper.prepareMessage();
	msg.setRequestHeader(new HttpRequestHeader(requestMethod, requestUri, HttpHeader.HTTP10));
	msg.setRequestBody(requestBody);

	// Send the authentication message and return it
	helper.sendAndReceive(msg);
	print("Received response status code: " + msg.getResponseHeader().getStatusCode());

	return msg;
}
function authenticate(helper, paramsValues, credentials) {
	print("Authenticating via JavaScript script...");

	// Make sure any Java classes used explicitly are imported
	var HttpRequestHeader = Java.type("org.parosproxy.paros.network.HttpRequestHeader")
	var HttpHeader = Java.type("org.parosproxy.paros.network.HttpHeader")
	var URI = Java.type("org.apache.commons.httpclient.URI")

	// Prepare the login request details
	var requestUri = new URI(paramsValues.get("Target URL"), false);
	var requestMethod = HttpRequestHeader.POST;
	
	// Build the request body using the credentials values
	var extraPostData = paramsValues.get("Extra POST data");
	var requestBody = paramsValues.get("Username field") + "=" + encodeURIComponent(credentials.getParam("Username"));
	requestBody+= "&" + paramsValues.get("Password field") + "=" + encodeURIComponent(credentials.getParam("Password"));
	if(extraPostData.trim().length() > 0)
		requestBody += "&" + extraPostData.trim();

	// Build the actual message to be sent
	print("Sending " + requestMethod + " request to " + requestUri + " with body: " + requestBody);
	var msg = helper.prepareMessage();
	msg.setRequestHeader(new HttpRequestHeader(requestMethod, requestUri, HttpHeader.HTTP10));
	msg.setRequestBody(requestBody);

	// Send the authentication message and return it
	helper.sendAndReceive(msg);
	print("Received response status code: " + msg.getResponseHeader().getStatusCode());

	return msg;
}
function authenticate ( helper , paramsValues , credentials ) { print ( "Authenticating via JavaScript script..." ) ; // Make sure any Java classes used explicitly are imported var HttpRequestHeader = Java . type ( "org.parosproxy.paros.network.HttpRequestHeader" ) var HttpHeader = Java . type ( "org.parosproxy.paros.network.HttpHeader" ) var URI = Java . type ( "org.apache.commons.httpclient.URI" ) // Prepare the login request details var requestUri = new URI ( paramsValues . get ( "Target URL" ) , false ) ; var requestMethod = HttpRequestHeader . POST ; // Build the request body using the credentials values var extraPostData = paramsValues . get ( "Extra POST data" ) ; var requestBody = paramsValues . get ( "Username field" ) + "=" + encodeURIComponent ( credentials . getParam ( "Username" ) ) ; requestBody += "&" + paramsValues . get ( "Password field" ) + "=" + encodeURIComponent ( credentials . getParam ( "Password" ) ) ; if ( extraPostData . trim ( ) . length ( ) > 0 ) requestBody += "&" + extraPostData . trim ( ) ; // Build the actual message to be sent print ( "Sending " + requestMethod + " request to " + requestUri + " with body: " + requestBody ) ; var msg = helper . prepareMessage ( ) ; msg . setRequestHeader ( new HttpRequestHeader ( requestMethod , requestUri , HttpHeader . HTTP10 ) ) ; msg . setRequestBody ( requestBody ) ; // Send the authentication message and return it helper . sendAndReceive ( msg ) ; print ( "Received response status code: " + msg . getResponseHeader ( ) . getStatusCode ( ) ) ; return msg ; }
The authenticate function is called whenever ZAP requires to authenticate, for a Context for which this script was selected as the Authentication Method. The function should send any messages that are required to do the authentication and should return a message with an authenticated response so the calling method.  NOTE: Any message sent in the function should be obtained using the 'helper.prepareMessage()' method.  Parameters: helper - a helper class providing useful methods: prepareMessage(), sendAndReceive(msg) paramsValues - the values of the parameters configured in the Session Properties -> Authentication panel. The paramsValues is a map, having as keys the parameters names (as returned by the getRequiredParamsNames() and getOptionalParamsNames() functions below) credentials - an object containing the credentials values, as configured in the Session Properties -> Users panel. The credential values can be obtained via calls to the getParam(paramName) method. The param names are the ones returned by the getCredentialsParamsNames() below
The authenticate function is called whenever ZAP requires to authenticate for a Context for which this script was selected as the Authentication Method . The function should send any messages that are required to do the authentication and should return a message with an authenticated response so the calling method . NOTE : Any message sent in the function should be obtained using the helper . prepareMessage () method . Parameters : helper - a helper class providing useful methods : prepareMessage () sendAndReceive ( msg ) paramsValues - the values of the parameters configured in the Session Properties - > Authentication panel . The paramsValues is a map having as keys the parameters names ( as returned by the getRequiredParamsNames () and getOptionalParamsNames () functions below ) credentials - an object containing the credentials values as configured in the Session Properties - > Users panel . The credential values can be obtained via calls to the getParam ( paramName ) method . The param names are the ones returned by the getCredentialsParamsNames () below