Scan a user flow with custom flow
What a custom flow scan does
A custom flow scan opens a browser window and lets you navigate the site yourself. You choose which pages to scan by selecting Scan page on each one. Use it for pages that a crawler cannot reach on its own, such as pages that appear only after you complete a form or sign in.
Custom flow scans always run with a visible browser window. This guide covers the steps to run one and the options that apply. It does not cover how Oobee finds pages in other scan types.
Prerequisites
- Oobee installed. Refer to Install the portable Oobee.
- The URL of the page to start from.
- A computer with a display, because the browser window cannot run in the background.
Step 1: Start a custom flow scan
Start the scan with the CLI, giving the start URL. Add -j to name the flow in the report.
npm run cli -- -c custom -u <START_URL> -j "<FLOW_LABEL>" -k "<YOUR_NAME>:<YOUR_EMAIL>"The label can be up to 80 characters and cannot contain characters that are forbidden in folder names. To start from the interactive prompts instead, run npm start, choose Custom, and enter the start URL and an optional label.
A browser window opens on the start page, with the Oobee toolbar overlaid on the page.
Step 2: Scan the pages you choose
Navigate to a page, then select Scan page in the toolbar or press Ctrl+Shift+X (Cmd+Shift+X on macOS). Repeat on each page and each state of a page that you want to check.
The toolbar shows the number of pages scanned and lists them. You can drag the toolbar if it covers part of the page.
Step 3: End the scan
Select End scan in the toolbar, or close the browser window. If a dialog asks “Are you sure you want to stop this scan?”, select Stop scan to confirm, or No, continue scan to carry on. Oobee then builds the report in the results folder.
Exclude pages from scans
To stop Oobee scanning certain pages, such as a sign-in page, list a pattern for each in a text file, one per line. Oobee reads exclusions.txt in the folder you run from by default. To use a different file, add -x <FILENAME>.
\.*login.singpass.gov.sg\.*
\.*login.microsoftonline.com\.*Each line is a regular expression that is matched against page URLs. Oobee rejects a pattern that it judges unsafe and shows the pattern in an error.
Constraints and limitations
| Constraint | Detail |
|---|---|
| Page limit | -p is not available for custom flow scans. |
| Browser window | Custom flow scans run with a visible window. |
| Flow label | At most 80 characters, with no characters that are forbidden in folder names. |
| Exclusion patterns | Patterns are regular expressions. Unsafe patterns are refused. |
| Playwright versions | If the flow fails to start, you may have more than one Playwright version installed. Refer to Troubleshooting. |
Related content
- Run a scan — other scan types and shared options.
- Scan pages behind a login — send credentials with a scan.
- CLI options, environment variables and error codes — every option and default.
