Tests dynamiques de sécurité (DAST) sous OWASP Zap avec authentification via JWT/bearer token (OpenID Connect/OAuth & Kong)

login.py

# Fonction générique pour faire une requête GET
def callGet(requestUrl, headers, helper):
    requestUri = URI(requestUrl, False);
    print "-----start of callGet-------";
    print "requestUrl:"+requestUrl;
    msg = HttpMessage();
    requestHeader = HttpRequestHeader(HttpRequestHeader.GET, requestUri, HttpHeader.HTTP10);
    msg.setRequestHeader(requestHeader);
 
    for name, value in headers.items():
        requestHeader.setHeader(name, value);
 
    print "Sending GET request: " + str(requestHeader);
 
    helper.getHttpSender().sendAndReceive(msg)
    print "Received response status code for authentication request: " + str(msg.getResponseHeader());
    print("\nResponseBody: " + str(msg.getResponseBody()));
    print "------------------------------------";
    return msg;

# Fonction générique pour faire une requête POST
def callPost(requestUrl, requestBody, headers, cookies, contentType, helper):
    print "-----start of callPost ("+requestUrl+")-------";
 
    requestUri = URI(requestUrl, False);
    msg = HttpMessage();
    requestHeader = HttpRequestHeader(HttpRequestHeader.POST, requestUri, HttpHeader.HTTP10);
    requestHeader.setHeader("content-type",contentType);
 
    for name, value in headers.items():
        requestHeader.setHeader(name, value);
 
    requestHeader.setCookies(cookies)
    msg.setRequestHeader(requestHeader);
    msg.setRequestBody(requestBody);
    print("Sending POST request header: " + str(requestHeader));
    print("Sending POST request body: " + str(requestBody));
    helper.getHttpSender().sendAndReceive(msg);
    print("\nReceived response status code for authentication request: " + str(msg.getResponseHeader()));
    print("\nResponseBody: " + str(msg.getResponseBody()));
    print("------------------------------------");
    return msg;