zaproxy/zaproxy · error · ApiException

MISSING_PARAMETER

MISSING_PARAMETER

Error message

MISSING_PARAMETER (loggedInIndicator)

What it means

ApiException.Type.MISSING_PARAMETER with param name loggedInIndicator is thrown when the action setLoggedInIndicator is invoked without a non-empty loggedInIndicator parameter. VerificationAPI requires the regex string because an empty logged-in indicator is meaningless for session verification. JSONObject.getString returns null for absent keys here, triggering the guard.

Source

Thrown at zap/src/main/java/org/zaproxy/zap/extension/authentication/VerificationAPI.java:144

                        getContext(params).getVerificationMethod().getLoggedOutIndicatorPattern();
                return new ApiResponseElement(
                        "logged_out_regex",
                        loggedOutPattern != null ? loggedOutPattern.toString() : "");
            default:
                throw new ApiException(ApiException.Type.BAD_VIEW);
        }
    }

    @Override
    public ApiResponse handleApiAction(String name, JSONObject params) throws ApiException {
        LOGGER.debug("handleApiAction {} {}", name, params);

        Context context;
        switch (name) {
            case ACTION_SET_LOGGED_IN_INDICATOR:
                String loggedInIndicator = params.getString(PARAM_LOGGED_IN_INDICATOR);
                if (loggedInIndicator == null || loggedInIndicator.isEmpty())
                    throw new ApiException(Type.MISSING_PARAMETER, PARAM_LOGGED_IN_INDICATOR);
                context = getContext(params);
                context.getVerificationMethod().setLoggedInIndicatorPattern(loggedInIndicator);
                context.save();
                return ApiResponseElement.OK;

            case ACTION_SET_LOGGED_OUT_INDICATOR:
                String loggedOutIndicator = params.getString(PARAM_LOGGED_OUT_INDICATOR);
                if (loggedOutIndicator == null || loggedOutIndicator.isEmpty())
                    throw new ApiException(Type.MISSING_PARAMETER, PARAM_LOGGED_OUT_INDICATOR);
                context = getContext(params);
                context.getVerificationMethod().setLoggedOutIndicatorPattern(loggedOutIndicator);
                context.save();
                return ApiResponseElement.OK;

            case ACTION_SET_VERIFICATION_METHOD:
                context = getContext(params);
                AuthCheckingStrategy strategy;
                try {

View on GitHub (pinned to 9d1970a436)

Solutions

  1. Add a non-empty loggedInIndicator regex parameter, e.g. loggedInIndicator=.*Welcome,\s+user.*
  2. Verify the parameter key is exactly 'loggedInIndicator' (camelCase) in the query string or form body.
  3. Check the source config/secret store for a blank value and populate it before calling the action.
  4. Ensure your HTTP client is not dropping parameters with empty values from the query string.

Example fix

// before: missing param
curl 'http://zap/JSON/auth/action/setLoggedInIndicator/?contextId=1'
// after
curl 'http://zap/JSON/auth/action/setLoggedInIndicator/?contextId=1&loggedInIndicator=.*Logout.*'
Defensive patterns

Strategy: validation

Validate before calling

if (!params.loggedInIndicator || params.loggedInIndicator.trim() === "") {
  throw new Error("loggedInIndicator is required and must be a non-empty regex");
}

Type guard

function isNonEmptyString(v) {
  return typeof v === "string" && v.length > 0;
}

Try / catch

try {
  await zapApi.action("setLoggedInIndicator", params);
} catch (e) {
  if (e.code === "MISSING_PARAMETER" && e.detail === "loggedInIndicator") {
    throw new Error("Provide a non-empty loggedInIndicator regex for setLoggedInIndicator");
  }
  throw e;
}

Prevention

When it happens

Trigger: Calling action /JSON/auth/action/setLoggedInIndicator/ with the loggedInIndicator parameter omitted, sent as empty string, or sent with a JSON null value.

Common situations: Automation scripts that build the request dynamically and skip empty values; provisioning tools whose config has a blank 'loggedInIndicator' field; confusing this action with setLoggedOutIndicator and sending the wrong parameter name.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of zaproxy/zaproxy@9d1970a436 (2026-09-05). Data as JSON: /api/errors/dd116a94f071fa04. Report an issue: GitHub.