Support throttling in Spider

Is your feature request related to a problem? Please describe.

The Spider does not support throttling, so is always set to make requests as fast as it can. In some cases this is undesirable, as this can cause availability issues with brittle targets.

Describe the solution you'd like

The spider should support a delayInMs parameter (like the active scanner), which will delay requests by the given value to reduce the load on target web applications.

Describe alternatives you've considered

It's possible to replicate this behaviour by running ZAP through another proxy that supports throttling, but this is clunky.

Screenshots

No response

Additional context

No response

Would you like to help fix this issue?

• [ ] Yes

I am happy to work on a fix for this myself, I appreciate it's not a super common use case. Just wanted to add an issue and invite commentary in case anyone has any thoughts before I submit a PR.

Sounds good to me :) Would you like to be assigned this issue?

Sure.

Duplicate of #1314 but I guess we can keep this one.

This should be done in the add-on now, located in the zap-extensions repo.

Hello, @slicedpan

Thank you for your making this issue! Actually, I have wanted to use this feature, too.

Then, how is it going on this task? If it's hard for you to try this task, I would like to try this task :)

I apologize for this suggestion if you are mid-way through this task.

fwiw, there's an add-on in progress providing this more generally: zaproxy/zap-extensions#4011.

@thc202 Thank you for the useful information! I will wait for the PR to be merged.

Closing as done with the global rate limiting, while adding per scan/tool seems useful it does not actually allow to enforce the limits (as the user can easily/accidentally exceed them, e.g. active scan, manual).

Feel free to leave a comment explaining the use case if you still think having per scan is useful.

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.