{"action":"created","issue":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1901","labels_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1901/labels{/name}","comments_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1901/comments","events_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1901/events","html_url":"https://github.com/zaproxy/zaproxy/issues/1901","id":106580084,"number":1901,"title":"ZAP checks robots file before doing script base authentication when doing indexation","user":{"login":"Wawki","id":3777850,"avatar_url":"https://avatars.githubusercontent.com/u/3777850?v=3","gravatar_id":"","url":"https://api.github.com/users/Wawki","html_url":"https://github.com/Wawki","followers_url":"https://api.github.com/users/Wawki/followers","following_url":"https://api.github.com/users/Wawki/following{/other_user}","gists_url":"https://api.github.com/users/Wawki/gists{/gist_id}","starred_url":"https://api.github.com/users/Wawki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Wawki/subscriptions","organizations_url":"https://api.github.com/users/Wawki/orgs","repos_url":"https://api.github.com/users/Wawki/repos","events_url":"https://api.github.com/users/Wawki/events{/privacy}","received_events_url":"https://api.github.com/users/Wawki/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-15T15:23:10Z","updated_at":"2015-09-15T15:49:23Z","closed_at":null,"body":"When we check the option \"check robots.txt\", when doing indexation, ZAP checks it before doing the script base authentication.\r\n\r\nIt's a problem for our website because when you go on it, it gives you a cookie. After the authentication, we have another cookie. The website checks for the 2 cookies before allow access to a page.\r\n\r\nSo when ZAP checks for robots.txt, the website gives him a cookie (example \"ABC\") and the pages discovered after that are made with this cookie, so here the user is not authenticated and we may encountered some redirect to login page.\r\n\r\nIn parallel, we have our script base authentication, here the website gives him another cookie (example \"CDF\") . The script authenticates the user and receives another cookie (example \"12345\") (here we have 2 cookies). So the pages discovered after that are made with these 2 cookies. All is good here :)\r\n\r\nIn short we have 2 authentication cookies in parallel (\"ABC\" and \"CDF\") running around because of multithreading.\r\n\r\nI'm not sure to be clear , please get back to me if I am not."},"comment":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/comments/140438353","html_url":"https://github.com/zaproxy/zaproxy/issues/1901#issuecomment-140438353","issue_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1901","id":140438353,"user":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"created_at":"2015-09-15T15:49:23Z","updated_at":"2015-09-15T15:49:23Z","body":"So you're saying access to your robots.txt requires authentication?"}}