To set up authentication for a DAST scan, create a dedicated low-risk test account, teach the scanner how to log in, and define a check that proves it is still signed in during the scan. Without that check, many scans quietly run logged out and report on a login page.
Why authentication matters
ZAP's documentation states that applications requiring authentication must be configured in ZAP, or it cannot reach their protected functionality. Most of an app's attack surface sits behind login, so an unauthenticated scan covers a small slice.
Common login patterns
| App behavior | Approach | Watch for |
|---|---|---|
| HTML form login with cookie session | Record the login request, reuse the cookie | CSRF tokens in the form |
| Token in an Authorization header | Fetch a token, send it on each request | Expiry mid-scan |
| Single sign-on redirect | Use a test user, or a script that follows the redirect | MFA prompts |
| API key header | Add a static header | Keys that rotate |
Steps
- Create a test account per role you care about, such as user and admin. Do not reuse a real person's account.
- Seed it with fake data so a scan that edits or deletes records does no harm.
- Capture the login flow with a proxy so you see every field, cookie and redirect.
- Configure the scanner to repeat that flow, and to repeat it when the session ends.
- Define a logged-in indicator, such as text only shown to signed-in users, and a logged-out indicator, such as the login form.
- Exclude the logout URL and any password change or account deletion paths from the crawl, or the scanner will end its own session.
- Run a short crawl and confirm in the results that account pages were reached.
Handling MFA and SSO
Scanners cannot answer a one-time code prompt. For staging, either disable MFA for the scan account through a documented exception, or use a token your identity provider issues for automation. Keep that exception off production.
How to know it worked
Check the list of crawled URLs for pages that need a session. If you see only public pages and the login form, authentication failed even if the scan reported success.
Try it yourself
Open the authenticated scan option and compare the pages found with and without a session.
Click through it at your own pace, or open it full screen.
Quick check
Should the scan account be an admin?
Scan separately as each role. An admin scan reaches more code, but scan as a normal user too, to catch privilege problems.
Why does my scan log out repeatedly?
Often the crawler visits the logout link or the session expires. Exclude logout and add a re-login rule.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
