Release 2.10.0

This is a 10 year anniversary bug fix and enhancement release, which requires a minimum of Java 8. Note that a minimum of Java 11 is recommended, especially for high DPI displays.

These release notes do not include all of the changes included in add-ons updated since 2.9.0.

Some of the more significant enhancements include:

Custom Pages

Custom Pages can be defined on a per context basis - these allow ZAP to identify various non-standard error handling conditions such as custom error pages and handle them more effectively.

Authentication Polling

The concept of Authentication Verification Strategies has been introduced which allows ZAP to handle a wider range of authentication mechanisms including the option to poll a specified page for the authentication status of a user.

Site Tree Control

Scripts and add-ons now have full access to how nodes are represented in the Sites Tree. Both Input Vector Scripts and add-ons which include implementations of the Variant class can change both the tree structure and names used for new nodes.

For more details see the Site Tree Modifiers Blog post.

Dynamic Look and Feel including Dark Mode

The Desktop UI includes a new set of open source Look and Feel's c/o FlatLaf including 2 Dark Mode options.
You can also dynamically switch the Look and Feel via a button on the Top Level Toolbar.

For more details of the dark mode see the Dark Mode in the Weekly Release Blog post.

Authentication Headers via Env Vars

A new set of environmental variables are available which allow you to easily add an authentication header to all of the requests that are proxied through ZAP or initiated by the ZAP tools, including the spiders and active scanner. These are documented on the Authentication page.

SOCKS Proxy Configuration

It is now possible to dynamically configure the outgoing SOCKS proxy in the Options' Connection screen. By default the SOCKS proxy configuration applies to all connections made by ZAP.

Cached Scripts

The following script types are now cached between invocations reducing the time it takes to reuse them:

Add-Ons

New Add-Ons

The following add-ons are included by default in this release for the first time:

Updated Add-Ons

The following add-ons have been updated since the last full release:

Docker Updates

The following changes are included in the latest Stable Docker image: For full list of changes made to the docker images see the docker CHANGELOG.md.

Changes in Bundled Libraries

The following libraries were updated:

Logging Library

The logging library, Log4j, was updated to the new major version (2.x). The previous version is still included for compatibility with existing code, add-on and script authors are encouraged to migrate to the new API.
For example, the logger can now be obtained with: 
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

// ...

Logger logger = LogManager.getLogger(MyClass.class);

Enhancements

Bug Fixes

ZAP API New Endpoints:

VIEW ascrf / optionPartialMatchingEnabled

Define if ZAP should detect CSRF tokens by searching for partial matches

ACTION ascrf / setOptionPartialMatchingEnabled

Define if ZAP should detect CSRF tokens by searching for partial matches.

ACTION alert / updateAlertsConfidence

Update the confidence of the alerts.

ACTION alert / updateAlertsRisk

Update the risk of the alerts.

ACTION context / setContextCheckingStrategy

Set the checking strategy for a context - this defines how ZAP checks that a request is authenticated.

VIEW core / optionUseSocksProxy

Gets whether or not the SOCKS proxy should be used.

ACTION core / setOptionUseSocksProxy

Sets whether or not the SOCKS proxy should be used.

VIEW users / getAuthenticationState

Gets the authentication state information for the user identified by the Context and User Ids.

VIEW users / getAuthenticationSession

Gets the authentication session information for the user identified by the Context and User Ids, e.g. cookies and realm credentials.

Action users / authenticateAsUser

Tries to authenticate as the identified user, returning the authentication request and whether it appears to have succeeded.

Action users / pollAsUser

Tries to poll as the identified user, returning the authentication request and whether it appears to have succeeded. This will only work if the polling verification strategy has been configured.

Action users / setAuthenticationState

Sets fields in the authentication state for the user identified by the Context and User Ids.

Action users / setCookie

Sets the specified cookie for the user identified by the Context and User Ids.

See Also

    Introductionthe introduction to ZAP
    Releasesthe full set of releases
    Creditsthe people and groups who have made this release possible