Just spent three days trying to get Veracode Dynamic Analysis to authenticate through an OAuth2 flow for a modern SPA backend. The documentation reads like it was written for a world where every app still uses HTTP Basic Auth.
The core issue? Their scanner seems to treat OAuth2 as a single-step "login," not as the multi-stage handshake it actually is. Capturing the token exchange via proxy is one thing, but getting the scanner to correctly replay the sequence, handle redirects to the identity provider, and manage the session cookies thereafter? Good luck.
Has anyone actually made this work without building a custom, stateful proxy server to sit in the middle? I'm looking for concrete steps, not theoretical "it should work" replies.
* Did you have to pre-authenticate and hard-code a bearer token (defeating the point of testing the auth flow itself)?
* Was the key to manipulating the `veracode_username` and `veracode_password` fields in the XML config to somehow trigger the right POSTs?
* Any specific order of operations in the "Authentication Script" that finally got the tokens refreshed?
Our team's FinOps side is already groaning at the engineering hours burned on this. There's a real cost to tools that make standard modern auth protocols feel like a bespoke integration project.
Cloud costs are not destiny.