Skip to main content
In this walkthrough, we’ll adapt our Dynamic Application Security Testing (DAST) with OWASP ZAP to ignore a specific warning—“Unexpected Content-Type”—so that the Jenkins build can proceed uninterrupted.

​
1. Identify the Unexpected-Content-Type Warning

Run the standard ZAP API scan: 
chmod 777 "$(pwd)"
docker run -v "$(pwd)":/zap/wrk/:rw ghcr.io/zaproxy/zap-api-scan.py \
  -t http://134.209.155.222:30000/api-docs/ \
  -f openapi \
  -r zap_report.html \
  -w zap_report.md \
  -J zap_json_report.json \
  -x zap_xml_report.xml
You’ll see: 
WARN: NEW: Unexpected Content-Type was returned [100001]
Normally this requires a code fix, but for demo purposes we’ll instruct ZAP to ignore this rule.

​
2. Generate and Customize the ZAP Rule Configuration

ZAP supports three levels for each rule:
LevelBehavior
FAILTreat as error and exit non-zero
WARNReport warning but continue (default)
IGNORESkip reporting the rule entirely
  1. Generate the default config: 
    docker run --rm ghcr.io/zaproxy/zap-api-scan.py -g zap_default.conf
  2. Open zap_default.conf—you’ll see lines like: 
    0       WARN (Directory Browsing - Active/release)
10019   WARN (Content-Type Header Missing - Passive/release)
...
  3. Modify or add the entry for rule 100001 with single tabs: 
    100001<TAB>IGNORE<TAB>http://134.209.155.222:30000/api-docs/
  4. Save this as zap_ignore_rules.
Be sure to use single tab separators. Mixing spaces or multiple tabs will cause parsing errors.

​
3. Update Your Jenkins Pipeline

In your Jenkinsfile, add the -c zap_ignore_rules flag to the DAST stage: 
stage('DAST - OWASP ZAP') {
    when { branch 'PR*' }
    steps {
        sh '''
        chmod 777 "$(pwd)"
        docker run -v "$(pwd)":/zap/wrk/:rw ghcr.io/zaproxy/zap-api-scan.py \
          -t http://134.209.155.222:30000/api-docs/ \
          -f openapi \
          -r zap_report.html \
          -w zap_report.md \
          -J zap_json_report.json \
          -x zap_xml_report.xml \
          -c zap_ignore_rules
        '''
    }
    post {
        always {
            publishHTML(
                allowMissing: true,
                alwaysLinkToLastBuild: true,
                keepAll: true,
                reportDir: './',
                reportFiles: 'zap_report.html',
                reportName: 'DAST - OWASP ZAP Report'
            )
        }
    }
}

​
4. (Optional) Front-End Cosmetic Change for Demo

Add extra rockets in index.html to visualize a change in your application: 
<body>
  <div>
    <a href="index.html">
      <button style="font-size:40px;">
        <i class="fa fa-rocket"></i> SOLAR <i class="fa fa-rocket"></i> SYSTEM
      </button>
    </a>
  </div>
</body>

​
5. Commit, Merge, and Sync with Argo CD

  1. Commit your changes and open a Pull Request.
  2. After merge, confirm in Jenkins:
The image shows a Jenkins pipeline interface for a project named "solar-system" under "Gitea-Organization," displaying various stages of a CI/CD process, including unit testing, code coverage, and deployment steps. It also includes a prompt asking if the pull request is merged and ArgoCD is synced, with options to confirm or abort.
  1. In Argo CD, sync the solar-system application:
The image shows the Argo CD dashboard displaying two applications: "bitnami-sealed-secrets" and "solar-system-argo-app," with their respective statuses and details. The interface includes options to sync, refresh, or delete the applications.
  1. Once synced, inspect the updated replica set and pods:
The image shows an Argo CD application dashboard with a visual representation of a deployment pipeline, indicating the sync status and health of various components in a Kubernetes environment.

​
6. Troubleshoot Token-Parsing Errors

If you see: 
Failed to load config file zap_ignore_rules: Unexpected number of tokens on line - there should be at least 3, tab separated: 100001 IGNORE
Then your zap_ignore_rules likely has spaces instead of tabs.
Open the file in an editor and ensure exactly one <TAB> between each field:
vi zap_ignore_rules
# Should read:
100001<TAB>IGNORE<TAB>http://134.209.155.222:30000/api-docs/
Recommit and rerun the pipeline.

​
7. Verify Final DAST Results

A successful DAST stage shows: 
PASS: ...
IGNORE-NEW: Unexpected Content-Type was returned [100001] x 83
FAIL-NEW: 0 WARN: 0 INFO: 0 IGNORE: 1 PASS: 112
Open the HTML report to confirm the ignored rule no longer blocks your build:
The image shows a ZAP Scanning Report detailing security alerts for various websites, with a summary indicating low and informational risk levels.

​
Summary & Next Steps

In this lesson, we:
  • Ran OWASP ZAP DAST against our API
  • Generated and customized an ignore-rules file
  • Updated our Jenkins pipeline to use -c zap_ignore_rules
  • Published the HTML report in Jenkins
  • Synced changes via Argo CD
  • Troubleshot tab-delimited config errors
Next, we’ll explore integrating serverless deployments with AWS Lambda.

Watch Video

Practice Lab