Scan pages behind a login

What this guide covers

By default, Oobee sees a site as a signed-out visitor. To scan pages that need a login, give Oobee credentials, headers or cookies, or scan from a browser session that is already signed in. This guide shows four methods and when to use each. It does not cover how to sign in to your own application.

Prerequisites

• Oobee installed. Refer to Install the portable Oobee.
• Permission to scan the site with the account you use.
• The credentials, header values or cookies for a test account. Use a test account rather than a personal one.

Choose a method

Send Basic Authentication credentials

Basic Authentication is the browser prompt that asks for a username and password. Use either form. Both work for sitemap, website, intelligent and custom flow scans.

Embed the credentials in the URL:

npm run cli -- -c website -u 'https://<USERNAME>:<PASSWORD>@<HOST>' -k "<YOUR_NAME>:<YOUR_EMAIL>"Copy to clipboardErrorCopied

Or send an Authorization header with -m, where the value is the Base64 encoding of <USERNAME>:<PASSWORD>:

npm run cli -- -c website -u 'https://<HOST>' -m "Authorization Basic <BASE64_CREDENTIALS>" -k "<YOUR_NAME>:<YOUR_EMAIL>"Copy to clipboardErrorCopied

Oobee sends the Authorization header only to the same origin as the start URL. Requests to other origins, such as content delivery networks, do not receive it.

Send request headers with the -m option

The -m option takes a header name and value separated by a space. For several headers, separate each pair with a comma and a space:

npm run cli -- -c website -u '<START_URL>' -m "Authorization Bearer <TOKEN>, X-Custom-Header <VALUE>" -k "<YOUR_NAME>:<YOUR_EMAIL>"Copy to clipboardErrorCopied

Oobee refuses a value that is not in the form <header> <value>.

Send cookies from a scripted login

If a site sets a session cookie after a login form, sign in with a script, collect the cookies, then pass them to Oobee as a cookie header. The following Playwright script signs in, builds the header and runs a one-page scan:

import { chromium } from 'playwright';
import { exec } from 'child_process';

const loginAndGetCookies = async (url, email, password) => {
  const browser = await chromium.launch({ headless: true });
  const page = await browser.newPage();

  await page.goto(url);
  await page.fill('input[name="email"]', email);
  await page.fill('input[name="password"]', password);
  await Promise.all([page.waitForNavigation(), page.click('input[type="submit"]')]);

  const cookies = await page.context().cookies();
  await browser.close();
  return 'cookie ' + cookies.map(cookie => `${cookie.name}=${cookie.value}`).join('; ');
};

const cookieHeader = await loginAndGetCookies('<LOGIN_URL>', '<EMAIL>', '<PASSWORD>');
const command = `npm run cli -- -c website -u "<PAGE_AFTER_LOGIN>" -p 1 -k "<YOUR_NAME>:<YOUR_EMAIL>" -m "${cookieHeader}"`;
exec(command, (error, stdout) => console.log(error ? error.message : stdout));Copy to clipboardErrorCopied

Add the cookie prefix once, before the first cookie. Oobee splits the -m value on a comma and a space, then on the first space, so a prefix on every cookie corrupts the second and later cookie names.

Change the selectors to match your login form. Save the script as a .mjs file, or set "type": "module" in package.json, because it uses import and top-level await. Run it with Node.js from the oobee folder. Use -p to cap the number of pages while you test. A cookie value that contains a double quote, a dollar sign or a comma and a space breaks this command. Pass such values with the -m option directly instead.

Scan from a signed-in browser session

Use a custom flow scan to sign in by hand, then scan the pages that follow. Start the scan, sign in in the browser window, and select Scan page on each page you want to check. Refer to Scan a user flow with custom flow.

On Windows and macOS, Oobee also copies the cookies from your installed Chrome profile into a temporary profile for each scan. If you are already signed in to the site in Chrome, a scan that uses Chrome can start signed in. Oobee deletes the temporary profile when the scan ends. If copying fails, Oobee continues with an empty profile and you may be signed out.

Constraints and limitations

Related content

• Run a scan — scan types and shared options.
• Scan a user flow with custom flow — scan pages you navigate to yourself.
• Troubleshooting — fix “Login required” and skipped pages.