Reading the result

The verdict

At the very top is what AuthTailor thinks of the login – in one sentence, with the next step. The pictures show a recording of the made-up app “Acme Orders”: the login works, but the API rejects an approval.

1. The verdict in four levels: All clear, Worth a look, Login breaks here or Nothing recognised. Below it the cause in one sentence.
2. Next step: what you should do now.
3. The counters: critical and high findings, medium findings and passed checks.
4. Flows in this input: which flow was recognised, here Authorization Code + PKCE. A click opens the explanation in Learning.
5. Load keys from … fetches the issuer’s public keys so that AuthTailor can check the signature of the JWTs. More in Tokens and SAML.

The security rating

Even a login that works can be insecure. The Security rating sorts all findings into five areas and gives each a traffic light.

1. The overall light – as red as the worst area.
2. A green area with the number of passed checks.
3. An opened area with its findings, each with consequence and fix.

Red means a critical or high finding, yellow a medium one. Plain notes (i) keep the light green. Purely functional findings such as a wrong audience or an expired token show up in the verdict, but do not count towards the security rating.

The login flow

For a recording or a HAR, AuthTailor draws the Login flow as a diagram with three lanes: browser, app and identity provider. Requests that are not part of the login are hidden.

1. The lanes with their hosts – here orders.acme.example as the app and login.acme.example as the identity provider.
2. A step with title, method, URL, status and time since the first step. The red dashed arrow is the step where it breaks. A click opens the step’s details.
3. Across the flow: checks that concern several steps together – does state come back unchanged, does the PKCE verifier match the challenge, are protective headers missing?

Headers of a step

If the Headers option was on during recording, each step shows its request and response headers. Values of cookies, Authorization and other secrets are masked.

1. The selected step.
2. Only problems hides the passed checks in the cards below.
3. Filter headers searches names and values.
4. Copy headers (masked) puts the headers on the clipboard, without the secrets.
5. Notable cookie attributes are highlighted – here SameSite=None.

Cards and report

Below the flow there is one card per recognised message: token, SAML message, login URL, token response. What the cards contain is described in Tokens and SAML.

• Copy report puts a Markdown report on the clipboard – verdict, flow, findings and fixes, masked. It fits into a ticket or a chat.
• Save cleaned HAR saves a recording or a HAR without secrets: headers, cookies, parameters and bodies masked, JWTs without signature.
• Expected values can be filled after a recording with Take from the recording, see Paste and examples.