ZAP Spider can't find form request on DVWA - zap

Question

I'm tring using OWASP ZAP and DVWA. I want to find all request using spider. I was setting below:
login admin user
include default context
Flag as Context: Formed-based Auth Login Request
add admin user
Forced user mode enable
Flag as Context: Authentication Logged-in indicator
try to spider:
https://github.com/makaaso/stackoverflow/blob/main/zap-dvwa1.png
result below:
https://github.com/makaaso/stackoverflow/blob/main/zap-dvwa2.png
I expect below(this is manual scan result):
https://github.com/makaaso/stackoverflow/blob/main/zap-dvwa3.png
Is it possible to find request with parameter using spider?

Answer 1

I did below and the spider was able to find the csrf URLs with parameters, I am using ZAP 2.10.0 and DVWA master zip package.
start a new session
double click Contexts / Default Context
Include in Context: https://127.0.0.1/dvwa/.*
Authentication - Formed-based Auth Login Request
Login Form Targe URL: https://127.0.0.1/dvwa/login.php
URL to get login form: https://127.0.0.1/dvwa/login.php
Login request post data: username={%username%}&password={%password%}&user_token={%user_token%}&Login=Login
Regx pattern for Logged In message: \QLocation: index.php\E
add user: admin / password
Excluded from Spider: \Qhttps://127.0.0.1/dvwa/logout.php\E
enable Forced user mode
Tools / Options / Anti-CSRF Tokens - add user_token
right click Contexts / Default Context > Spider
Starting point: https://127.0.0.1/dvwa/, select admin user
start scan
Spider Messages show
...
https://127.0.0.1/dvwa/vulnerabilities/csrf/
https://127.0.0.1/dvwa/vulnerabilities/csrf/?Change=Change&password_conf=ZAP&password_current=ZAP&password_new=ZAP&user_token=5bbc6fdff77b435b3f754518d236a368
https://127.0.0.1/dvwa/vulnerabilities/csrf/index.php
https://127.0.0.1/dvwa/vulnerabilities/csrf/index.php?Change=Change&password_conf=ZAP&password_current=ZAP&password_new=ZAP&user_token=3a8691e372ddd7b6f2c30f2a3feae1be
...