Product
Socket Now Supports uv.lock Files
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
@saucelabs/zaproxy
Advanced tools
The NodeJS implementation to access the OWASP ZAP API. For more information about OWASP ZAP consult the (main) OWASP ZAP project.
npm install zaproxy
By default ZAP requires an API key to be sent with every request. This is done automatically providing you supply the same API key when you instantiate the ZapClient
that you use to run ZAP with. All following API requests will use this same API key.
You can disable the API key when running ZAP if you are on a trusted network and understand the risks. If you choose to do so, you may omit the apiKey
property of the zapOptions
object supplied to ZapClient
.
const ZapClient = require('zaproxy');
const zapOptions = {
apiKey: <the key you supplied to ZAP when you started it>, // I.E. 'v90dnblpqs1pcac991tn2oudl'
proxy: <protocol>://<host>:<port> // I.E. 'http://192.168.0.10:8080'
};
const zaproxy = new ZapClient(zapOptions);
Callbacks:
zaproxy.spider.scanAsUser(contextId, userId, sutBaseUrl, maxChildren, recurse, subtreeonly, (err, resp) => {
if (err) // Handle the error.
if (resp) // Handle the response.
});
Promises:
await zaproxy.spider.scanAsUser(contextId, userId, sutBaseUrl, maxChildren)
.then(
resp => console.log(JSON.stringify(resp)),
err => `Error occurred while attempting to scan as user. Error was: ${err.message}`
);
For a full API list, see https://github.com/zaproxy/zaproxy/wiki/ApiGen_Index.
The Node API methods have the same signature as the API documentation, featuring both callback and promise based interfaces, making everyone happy.
The API key is no longer explicitly required on any Node API method invocations. Unless you have disabled the API key when running ZAP, simply provide it on Node API instantiation as mentioned in the Usage section and it will be provided automatically with each request to the ZAP API.
Callback mode: If you provide a callback as the last parameter, the callback will be called with error and response arguments, with the response being an object that corresponds to the JSON output of the API call.
Promise mode: If you wish to use the modern approach, simply don't provide a callback, and a native promise will be returned for you to deal with as you wish.
For help using the OWASP ZAP API refer to:
For specific help with this Node API, contact @binarymist (the maintainer).
To report issues related to the OWASP ZAP Node API, bugs and enhancements requests, use the issue tracker of the main OWASP ZAP project.
FAQs
ZAProxy Client API for Node.js
We found that @saucelabs/zaproxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 38 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.