Validating Browser Sessions
Post creation of browser sessions validate them to ensure successful scans
Browser session validation checks that a recorded session works before security scans. It verifies authentication, unauthenticated contrast, action replay, and parallel-tab behavior.
Validation States
Sessions have three states:
Pending Validation (Yellow) - Not yet validated. New sessions start here.
Validated (Green) - All checks passed. Ready for scans.
Validation Failed (Red) - At least one check failed. Fix issues before using.
Validation Checks
1. Authenticated Check
Checks whether the session authenticates correctly when loaded.
Loads the session cookies and storage.
Visits the authentication URL.
Compares the result to the expected authenticated page.
Passed: Shows authenticated content (dashboard, profile, etc.)
Failed: Shows login page or error (session expired/invalid)
2. Unauthenticated Check
Checks whether the site shows the unauthenticated page when no session is present.
Visits the same URL without session data.
Compares the result to the expected unauthenticated page.
Passed: Shows login page or "access denied"
Failed: Shows authenticated content (security issue)
3. Replay Test
Checks if the recorded browser actions can be replayed successfully.
Replays the recorded actions: clicks, typing, and navigation.
Compares the final page to the expected authenticated state.
Passed: Actions complete and result in authenticated state
Failed: Actions fail or don't reach authenticated state
4. Parallel Tab Testing
Checks whether the application can keep three authenticated tabs active at the same time.
Opens three tabs with the authenticated session.
Reloads all tabs simultaneously.
Passed: All tabs maintain the authenticated state after reloads
Failed: At least one tab loses the authenticated state.
How to Trigger Validation
Open External Assessment -> Run Assessment, continue to Scope, select the target asset, enable Authenticated, and click Record new session.
Select an existing session from the dropdown. The session loads in preview mode.
(Optional) Review or edit session details, context, tags, or browser actions.
Click Validate Session and wait for the validation results. Use the VNC URL to watch the validation run when needed.
Review results when they appear. Green borders mean passed and red borders mean failed. Click the eye icon to view screenshots.
Re-record or delete a failed session when it is no longer useful. Check saved schedules before deleting a session they may reference.
If any validation check fails, treat the session as unsafe for authenticated scans until it is fixed or re-recorded. Confirm all four checks pass before running an authenticated scan.
A few things to keep in mind
During recording make sure bounding boxes are completely loaded before doing any action (for eg: click/fill etc..) - if bounding boxes are not visible hit "Refresh" button in the actions toolbar.
Ensure the actions recorded do not have temporary tokens, one-time authentication data - this might lead to validation failure during replay
If the validation check fails the browser session manager will prompt what might have went wrong as a warning - you can use this information to re-record the browser session.
Last updated