Authenticated Scanning

Most real risk lives behind the login page. apPosture's authentication engine logs in and keeps a valid session so all engines - crawler, active scanner, and AI exploitation - test authenticated surface, not just the public pages.

Why it matters

Without auth, a scan only sees the marketing site and login form. With auth, it reaches dashboards, account settings, admin panels and APIs - where IDOR, broken access control and business-logic flaws actually occur.

Configure authentication on a target

1. Open the target and choose Edit authentication.
2. Select the method:

Form-based login

• Login URL, username/password fields, and credentials.
• The engine is CSRF-aware (it reads and replays anti-CSRF tokens) and supports multi-step logins.
• Provide a logged-in indicator (a URL or text only visible when authenticated) so the engine can detect session loss and re-authenticate.

API key / bearer token

• Supply the header name and value (e.g. Authorization: Bearer …). If a static token expires mid-scan, the engine detects the drop and warns that the login-gated surface was under-tested, so you re-run with a fresh token instead of trusting a shallow result.

Session cookie / OAuth

• Inject a captured session cookie, or configure an OAuth flow. For OAuth, the engine does a proactive mid-scan refresh - it re-mints the token within 60 seconds of expiry (rotation-safe via the refresh_token grant) so a long Deep scan never silently drops to the public surface halfway through.

MFA / TOTP

• Provide the TOTP secret so the engine can compute one-time codes during login.

Second principal (for access-control testing)

• Supply a second identity (a second header/token principal) so the engine can run true 2-user checks: it accesses one user's objects as the other and confirms a real cross-user read. This is what catches IDOR / BOLA on header-authenticated APIs, where a single session cannot.

Verify before you rely on it

After saving, use Test login (or run a Quick scan and check the coverage panel). If authenticated pages show up in the crawl, auth is working. If coverage looks shallow, the logged-in indicator is usually wrong.

Scope safety

• Exclude logout and destructive actions in the scan scope settings so the engine doesn't end its own session or trigger irreversible operations.

Keep credentials least-privilege

Use a dedicated test account with the minimum role needed to exercise the surface you care about - never a real admin account on production.