> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-an-external-scan/validating-browser-sessions.md).

# Validating Browser Sessions

Browser session validation checks that a recorded session works before security scans. It verifies authentication, unauthenticated contrast, action replay, and parallel-tab behavior.

### Validation States

Sessions have three states:

1. **Pending Validation (Yellow)** - Not yet validated. New sessions start here.
2. **Validated (Green)** - All checks passed. Ready for scans.
3. **Validation Failed (Red)** - At least one check failed. Fix issues before using.

### Validation Checks

<figure><img src="/files/vQsgv4Dc5T0tTvi8MYas" alt="" width="375"><figcaption></figcaption></figure>

#### 1. Authenticated Check

Checks whether the session authenticates correctly when loaded.

* Loads the session cookies and storage.
* Visits the authentication URL.
* Compares the result to the expected authenticated page.

Passed: Shows authenticated content (dashboard, profile, etc.)

Failed: Shows login page or error (session expired/invalid)

***

#### 2. Unauthenticated Check

Checks whether the site shows the unauthenticated page when no session is present.

* Visits the same URL without session data.
* Compares the result to the expected unauthenticated page.

Passed: Shows login page or "access denied"

Failed: Shows authenticated content (security issue)

***

#### 3. Replay Test

Checks if the recorded browser actions can be replayed successfully.

* Replays the recorded actions: clicks, typing, and navigation.
* Compares the final page to the expected authenticated state.

Passed: Actions complete and result in authenticated state

Failed: Actions fail or don't reach authenticated state

***

#### 4. Parallel Tab Testing

Checks whether the application can keep three authenticated tabs active at the same time.

* Opens three tabs with the authenticated session.
* Reloads all tabs simultaneously.

Passed: All tabs maintain the authenticated state after reloads

Failed: At least one tab loses the authenticated state.

***

### How to Trigger Validation

1. Open the settings drawer for the target domain and click **Record Browser Session** to open **Browser Session Manager**.

   <figure><img src="/files/ZIY7jwbQ8BF9ALV41lhV" alt=""><figcaption></figcaption></figure>
2. Select an existing session from the dropdown. The session loads in preview mode.
3. (Optional) Review or edit session details, context, tags, or browser actions.
4. Click **Validate Session** and wait for the validation results. Use the VNC URL to watch the validation run when needed.

   <figure><img src="/files/kLsRIoFkxODUIhDxCMfO" alt=""><figcaption></figcaption></figure>
5. Review results when they appear. Green borders = passed, red borders = failed. Click the eye icon to view screenshots.

{% hint style="warning" %}
If any validation check fails, treat the session as unsafe for authenticated scans until it is fixed or re-recorded. Confirm all four checks pass before running an authenticated scan.
{% endhint %}