Tools

Check

Paste one thing and get it checked: a passkey response (WebAuthn), certificates, keys, CSRs or a JWK, a CSP, the response headers of a login page, a CORS preflight, a suspicious login link – or any text, which is scanned for secrets.

1. The three sections: Check, Clean HAR, Page storage.
2. The field takes text or a file (.txt, .json, .pem, .crt, .cer, .csr, .key, .har, .properties).
3. Recognised: what AuthTailor found – here CORS.
4. The card with findings and fixes. Here PUT and authorization are missing from the allowed methods and headers.

The example tiles Weak CSP, Blocked CORS preflight, Suspicious login link and Passkey login show what a result looks like. AuthTailor sends a HAR to Auth Trace and SAP artefacts to SAP.

Passkey responses

AuthTailor takes a WebAuthn response (from the DevTools or a log) apart. Under Expected values you enter what your relying party expects.

1. Origin, RP ID and Challenge (as sent). Without them AuthTailor only checks origin and RP ID for plausibility.
2. The card with checks – origin, rpIdHash, user verified, synced passkey, signature counter – and the fields including the flags.

Clean HAR

Before a HAR goes to support or into a ticket: AuthTailor masks cookies, Authorization and session headers, codes, tokens, passwords and secret parameters. JWTs stay readable but lose their signature. Everything happens locally.

1. Response bodies: JSON only (masked), remove all or keep all (masked).
2. Keep SAMLResponse/SAMLRequest (contains user data) – only tick this if support really needs the SAML message.
3. Save cleaned HAR downloads the file as .sanitized.har, Copy puts it on the clipboard.
4. The card counts what was masked and scans the result once more for known secret patterns.

Page storage

Many single-page apps keep tokens in the browser. Page storage scans the storage of the active tab: localStorage, sessionStorage, IndexedDB and cookies readable by JavaScript.

1. Open the app in the tab and log in.
2. On that tab, open the panel with the icon in the toolbar.
3. In Tools → Page storage, click Scan this page.

1. Scan this page – after the first time Scan again.
2. The origin and how many entries were found in which storage.
3. The findings: here a refresh token in localStorage – one XSS away from being stolen –, JWTs in localStorage and sessionStorage and stored ID tokens.

The scan runs once in the page, on your click. Only type, length and harmless claims (iss, aud, exp, scopes) come back – never a value. Nothing is stored.

If you did not open the panel with the icon on that tab, the button reads Allow access and scan. Access is returned right after the scan. AuthTailor cannot scan browser pages or the extension store.