== Setting up browser

. Make sure you can change the certificate store and network proxy settings, use a portable browser version if necessary
. Import the ZAP root certificate in your trusted certificates
. Change the network proxy settings
. Use www.webgoat.local in stead of 127.0.0.1
.. adjust your host file and use www.webgoat.local



=== Import the OWASP ZAP root certificate

. Go to your Firefox Preferences (Mac, Linux) or Options (Windows) from the menu.`
. Search for _certificates_
. Click _View certificates_
. Import the ZAP root certificate that was saved (see previous page)

image::images/firefoxsettingscerts.png[Firefox Certificates,width="75%",style="lesson-image"]

image::images/importcerts.png[Firefox Cetificate import,width="75%",style="lesson-image"]

=== Firefox Proxy Config

. Go to your Firefox Preferences (Mac, Linux) or Options (Windows) from the menu.`
. Select _Advanced_ on the left
. Select _Network_ in the in Advanced Pane
. Click _Settings_
. Select _Manual proxy configuration_
.. input *127.0.0.1* as the Proxy
.. input *8090* as the port if running WebGoat locally and you updated ZAP to 8090 (otherwise, use *8080*)
.. check the _Use this proxy server for all protocols_ checkbox

image::images/firefox-proxy-config.png[Firefox Proxy Config,510,634,style="lesson-image"]

=== Use www.webgoat.local

*It is important to note that the latest versions of Firefox and Chrome no longer proxy traffic from localhost by default.*
The are a couple of options to bypass this restriction:

- Use the host name of your machine instead of `localhost`, you can find or add a host name in `/etc/hosts` on Linux and MacOSX and `C:\Windows\System32\drivers\etc` on Windows

image::images/newlocalhost.png[Hosts file,style="lesson-image"]

- To proxy localhost (and related addresses) with newer Firefox versions (>= 67) the preference network.proxy.allow_hijacking_localhost (accessible through the about:config page) must be set to true.
- To proxy localhost (and related addresses) with newer Chrome versions (>= 72) the command line argument --proxy-bypass-list=<-loopback> must be provided.


=== Chrome Proxy Config

. Bring up Chrome's settings form the menu
. In the _Search settings_ box type in *proxy* and hit Enter/Return. This should bring up the Network heading with a _Change proxy settings_ button.
. Click the _Change proxy settings_ button
. Select the _proxies_ tab
. Select Web Proxy (HTTP)
. Input 127.0.0.1 in the first box under _Web Proxy Server_ and your port # (8090 if running WebGoat locally, otherwise 8080) in the second box (to the right)
. You may also want to clear the _Bypass proxy settings for these Hosts & Domains_ text input at the bottom, but shouldn't need to


image::images/chrome-manual-proxy.png[Chrome Proxy Config,700,447,style="lesson-image"]

(Mac config image above)

image::images/chrome-manual-proxy-win.png[Chrome Proxy, 394,346,style="lesson-image"]

(Win config image above)


