Tools · Web testing tools · 16 / 23

A ZAP context that is only Harbor Ledger

A context is ZAP’s name for the set of URLs that belong to one application. The Harbor Ledger context includes http://127.0.0.1:3000 and can exclude static files and the logout path so a spider does not wander or sign you out.

15 min read · practice only with authorization

Name a context and include one origin

In ZAP, create a context named harbor-ledger. Add an include regular expression for the lab origin. The expression these lessons use is ^http://127\.0\.0\.1:3000(/|$). The caret ties the match to the start of the URL. Each \. is a literal dot, because a bare dot matches any character. (/|$) means “a slash, or the end of the URL,” so port 3000 matches and port 30000 does not. ZAP applies the expression as a search, which is why the caret matters: without it, a longer URL that merely contains the lab address can match. The tester in the dialog is part of the setup, not a decoration.

Test three strings. The invoice API URL should match. http://127.0.0.1:8080/ should not, because that is a proxy port and not the app. https://example.test/ should not. If the third matches, do not start a spider. Fix the expression. A context is the scope you are about to hand to anything automated.

Snippet

Context name: harbor-ledger
Include: ^http://127\.0\.0\.1:3000(/|$)

Matches:     http://127.0.0.1:3000/api/invoices/1042
Does not:    http://127.0.0.1:30000/
Does not:    http://127.0.0.1:8080/
Does not:    https://example.test/

Exclude logout and static files

Add excludes for ^http://127\.0\.0\.1:3000/static/ and ^http://127\.0\.0\.1:3000/logout($|[/?]). The static exclude keeps a spider on documents and API routes you can name. The logout exclude is the one that saves the session. A spider is diligent. If the signed-in page links to logout, the spider will fetch it, and every later request in that run will describe the signed-out app while your note still says Avery.

Excludes do not erase History. The first time you loaded the invoice page, /static/app.js was recorded, and it stays recorded. You will want that response when a front-end bug is the question. The exclude only tells context-aware actions to leave the path alone.

A lab user, if the spider needs one

Some pages in Harbor Ledger are visible only after sign-in. A spider with no session maps the sign-in page and stops. ZAP can store a context user and a session so the spider sends Avery’s cookie. Use the seed account from the lab README. Do not type a password you use anywhere else into ZAP’s authentication store. The store is a secret, and it lives with the session file.

After a spider run, check History for a logout request and for a sudden run of responses that look like the sign-in page. If you see them, the exclude failed or the app links to a logout URL you did not list. Fix the exclude, start a new session, and mark the polluted run in the note so you do not describe it as Avery’s map.

Worked case: prove the context with four URLs

Create the context with the include and the two excludes. Using the dialog’s tester or a careful reading of the regex, decide in, or out, for four URLs: the invoice API, /static/app.js, /logout, and a URL on example.test. The first is in. The other three are out. Write those four decisions in the note next to the expression.

Then spider only if the four decisions are right. When the spider finishes, the Sites tree should still have one host. History should not show a logout in the middle of the run. If either check fails, the context is not done, and another scan would only repeat the mistake faster.

Diagram

Include the origin, exclude the paths that confuse the session

Name
The context is called harbor-ledger, so later notes can point at it.
Include
The regex matches every URL on http://127.0.0.1:3000 and no other scheme, host, or port.
Exclude
Static assets and the logout path stay out of spider and scan actions.
Check
A URL you paste into the include tester is either in the context or it is not. Try both.

What the context includes

Anything fetched

Include. An empty include, or a regex that matches every host.

Spider. Follows a link off the lab and treats it as the app.

Logout. The spider fetches /logout and the rest of the run is anonymous.

One origin, two excludes

Include. http://127.0.0.1:3000 and paths under it.

Exclude. /static/ and /logout.

Spider. Stays on the app and keeps the session you gave it.

Context include and exclude

Context name: harbor-ledger

Include in context:
  ^http://127\.0\.0\.1:3000(/|$)

Exclude from context:
  ^http://127\.0\.0\.1:3000/static/
  ^http://127\.0\.0\.1:3000/logout($|[/?])

In context:  http://127.0.0.1:3000/api/invoices/1042
Out:         http://127.0.0.1:3000/static/app.js
Out:         http://127.0.0.1:8080/
Out:         https://example.test/

Check yourself

1. Which include belongs on the harbor-ledger context?

2. Why exclude ^http://127\.0\.0\.1:3000/logout($|[/?]) from the context?

3. You test the include regex with https://example.test/ and it matches. What is true?