> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-a-web-assessment/validating-browser-sessions.md).

# Validating Browser Sessions

Post creation of browser sessions validate them to ensure successful scans

Browser session validation checks that a recorded session works before security scans. It verifies authentication, unauthenticated contrast, action replay, and parallel-tab behavior.

### Validation States

Sessions have three states:

1. **Pending Validation (Yellow)** - Not yet validated. New sessions start here.
2. **Validated (Green)** - All checks passed. Ready for scans.
3. **Validation Failed (Red)** - At least one check failed. Fix issues before using.

### Validation Checks

#### 1. Authenticated Check

Checks whether the session authenticates correctly when loaded.

* Loads the session cookies and storage.
* Visits the authentication URL.
* Compares the result to the expected authenticated page.

Passed: Shows authenticated content (dashboard, profile, etc.)

Failed: Shows login page or error (session expired/invalid)

***

#### 2. Unauthenticated Check

Checks whether the site shows the unauthenticated page when no session is present.

* Visits the same URL without session data.
* Compares the result to the expected unauthenticated page.

Passed: Shows login page or "access denied"

Failed: Shows authenticated content (security issue)

***

#### 3. Replay Test

Checks if the recorded browser actions can be replayed successfully.

* Replays the recorded actions: clicks, typing, and navigation.
* Compares the final page to the expected authenticated state.

Passed: Actions complete and result in authenticated state

Failed: Actions fail or don't reach authenticated state

***

#### 4. Parallel Tab Testing

Checks whether the application can keep three authenticated tabs active at the same time.

* Opens three tabs with the authenticated session.
* Reloads all tabs simultaneously.

Passed: All tabs maintain the authenticated state after reloads

Failed: At least one tab loses the authenticated state.

***

### How to Trigger Validation

1. Open **Web Assessment -> Run Assessment**, continue to **Scope**, select the target asset, enable **Authenticated**, and click **Record new session**.
2. Select an existing session from the dropdown. The session loads in preview mode.
3. (Optional) Review or edit session details, context, tags, or browser actions.
4. Click **Validate Session** and wait for the validation results. Validation runs on a SANDBOX agent; it does not open a browser-recording VNC tab.
5. Review results when they appear. Green borders mean passed and red borders mean failed. Click the eye icon to view screenshots.
6. Re-record or delete a failed session when it is no longer useful. Check saved schedules before deleting a session they may reference.

{% hint style="warning" %}
If any validation check fails, treat the session as unsafe for authenticated scans until it is fixed or re-recorded. Confirm all four checks pass before running an authenticated scan.
{% endhint %}

### Tips for Sessions That Pass

1. While recording, wait until the element highlights finish loading before each click or entry. If an element is not highlighted, select **Refresh** in the recorder toolbar.
2. Do not record temporary tokens or one-time values as fixed text. They fail when the actions are replayed. Use the **Auth Actions** helpers for OTPs and magic links.
3. When a check fails, Browser Session Manager shows a warning that explains the likely cause. Use it to decide what to change before you re-record.

### Where Sessions Are Used

Validated sessions are used by both phases. Discovery crawls once per selected session to find what that role can reach, and Assessment tests each session's flows separately. Before every authenticated run, Pentest Copilot re-checks each selected session unless **Skip browser session validation** is turned on.