src/scripts/templates/authentication/Simple Form-Based Authentication.js
function authenticate(helper, paramsValues, credentials) {
	print("Authenticating via JavaScript script...");

	// Make sure any Java classes used explicitly are imported
	var HttpRequestHeader = Java.type("org.parosproxy.paros.network.HttpRequestHeader")
	var HttpHeader = Java.type("org.parosproxy.paros.network.HttpHeader")
	var URI = Java.type("org.apache.commons.httpclient.URI")

	// Prepare the login request details
	var requestUri = new URI(paramsValues.get("Target URL"), false);
	var requestMethod = HttpRequestHeader.POST;
	
	// Build the request body using the credentials values
	var extraPostData = paramsValues.get("Extra POST data");
	var requestBody = paramsValues.get("Username field") + "=" + encodeURIComponent(credentials.getParam("Username"));
	requestBody+= "&" + paramsValues.get("Password field") + "=" + encodeURIComponent(credentials.getParam("Password"));
	if(extraPostData.trim().length() > 0)
		requestBody += "&" + extraPostData.trim();

	// Build the actual message to be sent
	print("Sending " + requestMethod + " request to " + requestUri + " with body: " + requestBody);
	var msg = helper.prepareMessage();
	msg.setRequestHeader(new HttpRequestHeader(requestMethod, requestUri, HttpHeader.HTTP10));
	msg.setRequestBody(requestBody);

	// Send the authentication message and return it
	helper.sendAndReceive(msg);
	print("Received response status code: " + msg.getResponseHeader().getStatusCode());

	return msg;
}
function authenticate(helper, paramsValues, credentials) {
	print("Authenticating via JavaScript script...");

	// Make sure any Java classes used explicitly are imported
	var HttpRequestHeader = Java.type("org.parosproxy.paros.network.HttpRequestHeader")
	var HttpHeader = Java.type("org.parosproxy.paros.network.HttpHeader")
	var URI = Java.type("org.apache.commons.httpclient.URI")

	// Prepare the login request details
	var requestUri = new URI(paramsValues.get("Target URL"), false);
	var requestMethod = HttpRequestHeader.POST;
	
	// Build the request body using the credentials values
	var extraPostData = paramsValues.get("Extra POST data");
	var requestBody = paramsValues.get("Username field") + "=" + encodeURIComponent(credentials.getParam("Username"));
	requestBody+= "&" + paramsValues.get("Password field") + "=" + encodeURIComponent(credentials.getParam("Password"));
	if(extraPostData.trim().length() > 0)
		requestBody += "&" + extraPostData.trim();

	// Build the actual message to be sent
	print("Sending " + requestMethod + " request to " + requestUri + " with body: " + requestBody);
	var msg = helper.prepareMessage();
	msg.setRequestHeader(new HttpRequestHeader(requestMethod, requestUri, HttpHeader.HTTP10));
	msg.setRequestBody(requestBody);

	// Send the authentication message and return it
	helper.sendAndReceive(msg);
	print("Received response status code: " + msg.getResponseHeader().getStatusCode());

	return msg;
}
The authenticate function is called whenever ZAP requires to authenticate, for a Context for which this script was selected as the Authentication Method. The function should send any messages that are required to do the authentication and should return a message with an authenticated response so the calling method.  NOTE: Any message sent in the function should be obtained using the 'helper.prepareMessage()' method.  Parameters: helper - a helper class providing useful methods: prepareMessage(), sendAndReceive(msg) paramsValues - the values of the parameters configured in the Session Properties -> Authentication panel. The paramsValues is a map, having as keys the parameters names (as returned by the getRequiredParamsNames() and getOptionalParamsNames() functions below) credentials - an object containing the credentials values, as configured in the Session Properties -> Users panel. The credential values can be obtained via calls to the getParam(paramName) method. The param names are the ones returned by the getCredentialsParamsNames() below