_index.md

title	type	layout	links	cascade
Getting Further with Authentication	page	links	name link desc Authentication decision tree /docs/authentication/ start here, it might just solve all of your authentication problems name link desc How to make your life easier make-your-life-easier/ authentication is hard, don't make it harder than it needs to be name link desc Auto-Detection auto-detection/ if this works for you then it will make your life so much easier name link desc Documented SSO Solutions documented-sso-solutions/ these SSO providers have documented ways to make integration with tools like ZAP easier name link desc Manual authentication manual-auth/ how you can authenticate when testing manually name link desc ZAP authentication concepts concepts/ you will need to understand these in order to configure authentication in ZAP name link desc Handling authentication yourself in automation handling-auth-yourself/ how to handle authentication without as much ZAP configuration name link desc Finding a verification URL finding-a-verification-url/ you will need one of these name link desc Session handling session-handling/ how to configure ZAP to maintain sessions name link desc Authentication methods authentication-methods/ how ZAP authenticates to an app name desc Verification strategies Coming Soon name link desc Diagnosing authentication problems diagnosing-auth-problems/ what to do if you are getting stuck name desc Monitoring with statistics Coming Soon	EditableContent addBreadcrumbs true true

Most apps protect their main functionality using authentication. If you cannot authenticate to the app then you will not be able to find the most interesting and impactful vulnerabilities. Unfortunately authentication is hard, especially as there are so many different ways that apps handle authentication.

These pages will tell you everything you need to know about testing an app with valid credentials in ZAP, they do not cover testing the authentication mechanism itself.