search

garethr / zapr

Easy to use command line security scanner
MIT License
59 stars 6 forks source link

How do I pass `api.disablekey` config to ZAP? #2

Open pdehaan opened 9 years ago

pdehaan commented 9 years ago

I'm using zap2docker w/ Zapr v0.1.3 (via https://github.com/zaproxy/zaproxy/wiki/Docker#zapr), but I seem to be getting _"Invalid or missing API key (bad_apikey)" errors (see https://github.com/zaproxy/zaproxy/issues/1880).

Apparently I can pass -config api.disablekey=true to ZAP (per https://github.com/zaproxy/zaproxy/wiki/FAQapikey), but I'm not sure how to do that if I'm using the Zapr wrapper.

UPDATE: It looks like zap2docker is using OWASP ZAP 2.4.2, and according to the ZAP FAQ: "starting from version 2.4.1 ZAP creates an API key by default."