This article applies to:

• AppScanner 8.x

Question:

• Can I record requests from a third party application to my REST service for use in a web services traversal?

Response:

AppScanner can record the requests and responses from a third party application to create a traversal, provided that:

• The "Target is a web service" box was checked when the proxy traversal is started.  
• The third-party application is pointed at the AppScanner proxy while the proxy traversal is running.  
• The recorded proxy traversal can then be imported to a web services traversal.
• To record the requests and responses, the Proxy-Authorization header must be included with every request.  
• A Content-Type header must also be included in the response from the web server or the request will not be recorded.

Procedure:

1. When the traversal starts, ensure you copy the password presented.
   
   
2. You should then be prompted with an authentication box from the browser.  Choose any username and paste the password into the prompt.
   
   
3. If you open the developer tools and reload the page you can view the headers for the first request.  Ensure that the third party client sends the Proxy-Authorization header to our proxy server with every request.
   
   

Notes:

• Clients such as SoapUI have proxy settings, but regardless of these settings you must ensure the Proxy-Authorization header is added to every request so that AppScanner can record the request in the traversal script.  
• When AppScanner records the traversal in this way, the result will not have accurate counts for items such as "Pages Found" or "Forms Found".  These counts rely on the script that is injected by the product. This script cannot be injected with the third party client.  
• If you view the traversal script you will see all of the recorded requests.