multiauth testbed

label default since 2026-10-01T12:27:13Z · 3 users · 3 API hosts + the webapp

credentials cached per user: 3 logins per scan · re-authenticating per host: around 12, one per user per host the scanner touches

auto refresh · json · events · config.yaml · https://stats.91.134.90.21.sslip.io/reset?key=lab-reset&label=my-run

Logins per run (gap > 300s starts a new run)

#	first	last	logins	per user	breakdown
no login yet

Authentication logins (procedure)

key	value
total	0

Logins from scan traffic (Sec-Escape-User present)

none

Failed logins

none

Token exchanges

none

API requests per host

key	value
analytics:browser	4

Credential verdicts

key	value
analytics:browser:third_party	4

Credential sightings by class

none

Scoping defects (0)

class	seen on	issued for	user	where	path
none

How to read this

logins per run == 3                   credentials are cached per user
               around 12             authentication runs again for every host

*:browser:*                      traffic the authentication browser made, correct by construction
*:http_client:ok                 the scanner injected the token issued for that host
*:http_client:missing            under-injection, the scanner sent no credential
*:http_client:foreign            over-injection, a token of another host arrived

sightings *:expected             the host's own token
sightings *:domain_cookie        the single sign-on cookie, whose Domain covers every lab host
sightings *:over_injection       a host-specific token on a host it was not issued for
sightings analytics:*_leak       a third-party host received lab credentials