Authenticated Scanning
Most real risk lives behind the login page. apPosture's authentication engine logs in and keeps a valid session so all engines - crawler, active scanner, and AI exploitation - test authenticated surface, not just the public pages.
Why it matters
Without auth, a scan only sees the marketing site and login form. With auth, it reaches dashboards, account settings, admin panels and APIs - where IDOR, broken access control and business-logic flaws actually occur.
Configure authentication on a target
- Open the target and choose Edit authentication.
- Select the method:
Form-based login
- Login URL, username/password fields, and credentials.
- The engine is CSRF-aware (it reads and replays anti-CSRF tokens) and supports multi-step logins.
- Provide a logged-in indicator (a URL or text only visible when authenticated) so the engine can detect session loss and re-authenticate.
API key / bearer token
- Supply the header name and value (e.g.
Authorization: Bearer …).
Session cookie / OAuth
- Inject a captured session cookie, or configure an OAuth flow.
MFA / TOTP
- Provide the TOTP secret so the engine can compute one-time codes during login.
Verify before you rely on it
After saving, use Test login (or run a Quick scan and check the coverage panel). If authenticated pages show up in the crawl, auth is working. If coverage looks shallow, the logged-in indicator is usually wrong.
Scope safety
- Exclude logout and destructive actions in the scan scope settings so the engine doesn't end its own session or trigger irreversible operations.
Use a dedicated test account with the minimum role needed to exercise the surface you care about - never a real admin account on production.