Walkthrough: Getting Veracode DAST to work with our SPAs and APIs.

Hi everyone! I've been working on integrating Veracode DAST into our CI/CD pipeline, specifically to scan our Single Page Applications (React/Next.js) and the REST APIs that power them. It was trickier than I expected, so I thought I'd share my walkthrough.

The main hurdle was getting the scanner to properly authenticate and navigate the SPA to reach the API endpoints behind it. I ended up using a `veracode.yml` config file to script the login flow before the crawl starts. Here's a simplified version:

```yaml
scantype: dast
target_url: https://app.ourcompany.com
auth:
username: ${DAST_USER}
password: ${DAST_PASS}
login:
url: https://app.ourcompany.com/api/auth/login
method: POST
form:
username: ${DAST_USER}
password: ${DAST_PASS}
verifications:
- type: response_code
value: 200
```

For the APIs, I had to feed the scanner a Postman collection to define the endpoints and required headers (like API keys). Without that, it couldn't find most of our internal API routes. The key was making sure the auth token from the SPA login was correctly passed through to those API calls in the scan.

Anyone else gone through this? I'm curious if there are better ways to handle the session handoff between the SPA and the API scans. My dashboards are now showing these scans as part of the pipeline, which is cool! 🎉