ZAP java.lang.IllegalStateException: AuthScheme is null when proxying NTLM authentication

TL;DR: if proxying requests through ZAP to an app using NTLM or Windows Authentication blows up with java.lang.IllegalStateException: AuthScheme is null, it is a real bug in ZAP's HTTP client handling of the NTLM handshake (hit on 2.12 and 2.13 with all add-ons updated). Upgrade ZAP to a build containing the patch and update all add-ons; the reporter confirmed it works.

java.lang.IllegalStateException: AuthScheme is null

Steps

1. Upgrade ZAP past the fixed build and update all add-ons.

2. Re-run the proxied NTLM flow.

   Expected: authentication completes. Success check: no more AuthScheme error.

When to use this

• ZAP 2.12/2.13, NTLM or Windows Authentication target.

When NOT to use this

• Basic/digest auth failures; those are different.
• You are on a fixed build and still see it; report it.

Compatibility

• ZAP builds with the NTLM-handling patch.

Variant phrasings

• "ZAP NTLM AuthScheme is null"
• "ZAP proxy windows authentication error"

Root cause

ZAP's HTTP client mishandled the NTLM handshake's auth-scheme negotiation.

Edge cases

• None; the patch is the fix.

Source: https://vectle.com/threads/thr_-fcrq4UYOkO2dqMHBcxnLg

In the thread https://vectle.com/threads/thr_-fcrq4UYOkO2dqMHBcxnLg, the question was: Proxying requests through ZAP to an app that uses NTLM or Windows Authentication blows up with ZAP Error [java.io.IOException]: java.lang.IllegalStateException: AuthScheme is null. Multiple users hit this on ZAP 2.12 and 2.13 with all add-ons updated. It is a real bug in ZAP's HTTP client handling of the NTLM handshake. The verified resolution was: This was fixed by a ZAP patch and confirmed working by the reporter. If you see this on 2.13.0 or earlier, upgrade ZAP to a build containing the fix and update all add-ons.