Authenticated scanning (OAuth, OIDC, SSO)
Authenticated scanning tests the part of an app that only exists after you log in, which is where most real bugs live. Crossfyre supports static tokens, form logins, and OAuth2 / OIDC / SSO through a headless broker that logs in for you and returns only a resolved token, so your session-gated surface gets crawled and scanned.
Why does authenticated scanning matter?
An unauthenticated scan sees the login page and little else. The endpoints that handle real data, the account settings, the admin functions, the object IDs, all sit behind auth. If your scanner cannot log in, it never tests the surface where broken authorization, injection, and data exposure actually occur.
What login types does Crossfyre support?
Seven auth types feed authenticated crawl and authorization testing: static bearer, header, cookie, and basic auth; form login with session capture; non-interactive OAuth (client-credentials and password); and interactive OAuth authorization-code and SSO / MFA driven by a headless-Chromium auth broker that completes the login and hands back only a resolved token.
What happens to my credentials?
A credential is stored once, encrypted at rest, and resolved by reference at scan time, so the raw secret never re-transits the message bus. Interactive logins run in the broker, which returns a token rather than the password. You provide a login; Crossfyre never needs to expose the secret to the fleet.
How does it connect to authorization testing?
Every credential carries a role label (admin, user A, user B), which is exactly what the authorization engine needs to replay each endpoint as each identity. Authenticated scanning is what makes BOLA/BFLA/BOPLA testing possible in the first place.
Frequently asked
Does it handle SSO and MFA?
Yes, through a headless auth broker that performs the interactive login (including SSO/MFA flows) and returns a resolved session token. Non-interactive types run node-side; interactive types run in the broker.
Is authenticated scanning free?
It is a Pro-tier capability, enforced server-side, alongside authorization testing and managed OAST.