Introduce logout section for sechub webscan config to avoid logouts by the ajax crawler during scans

[winzj]

Siutation

Currently we do not notice when the webscan with ZAP performs a logout during the ajax crawler scan.
The regular spider and the active scan can be handled by defaults or adding excluded URLs to the webscan configuration.

Wanted

For the ajax crawler we want a specific section which specifies the logout html element.

Solution

Introduce a logout section inside the sechub webscan config. The following example might change before the implementation:

{
  "apiVersion": "1.0",
  "webScan": {
    "url": "https://example.org",
    "login": {
      "url": "https://example.org/login"
    },
    "logout": {
      "xpath": "//*[@id=\"loginButton\"]",
      "htmlElement": "button"
    }
  }
}

Important

• the logout section is optional, but when a logout section is defined xpath and htmlElement MUST be present