title: Testing Session Management with ZAP
body: <p>Is it possible to automatically test the session management with <a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project" rel="nofollow noreferrer">ZAP</a>?</p>
  <p>This should be possible, because ZAP is referenced as a tool for testing session management in the <a href="https://www.owasp.org/index.php/Testing_for_Session_Management_Schema_(OTG-SESS-001)#Gray_Box_testing_and_example" rel="nofollow noreferrer">OWASP Testing Guide</a>:</p>
  <blockquote>
  <p><strong>Tools</strong></p>
  <p>OWASP Zed Attack Proxy Project (ZAP) - <a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project" rel="nofollow noreferrer">https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project</a> - features a session token analysis mechanism.</p>
  </blockquote>
  <p>But I can't find any documentation how to test session managment.</p>
  <p>Note: There's a lot of documentation regarding <a href="https://stackoverflow.com/questions/31516420/adding-authentication-in-zap-tool-to-attack-a-url/43272057#43272057">how to add authentication to ZAP</a> but not how to test it.</p>