Web Application Definition Authentication Support

[coderpatros]

Following on from the auth discussion in the Web Application Definition 1.0.0 discussion there is a use case to handle authentication for DAST tools.

My initial thoughts are...

• authentication can be complicated, we can not cover all scenarios
• the implementation of how authentication is handled should be shifted downstream
• an authentication agnostic approach should be taken, i.e. invoking a script to return cookies/headers as required
• the first step should be defining a format for authentication headers/cookies to be provided for DAST tools to consume

[stevespringett]

I haven't looked into it, but OpenAPI 3 improved their authentication support over Swagger 2. It may be possible to reuse the work of the OpenAPI team, but further research may be necessary.

[coderpatros]

@psiinon do you think StackHawk might be interested in collaborating on this?

It looks like they've done some good work in this space Authenticated Scanning

[psiinon]

They already are - I work for StackHawk now :D

[coderpatros]

lol, I know that. What I mean is can we rip off build on what they already have? Or does it put you in a tricky spot if we re-use what they have already done?

I'm sort of thinking we should make use of more of what they already have. There's some great stuff there. Especially if they had a "free for open source projects" plan?