Authentication surface checker

A login entry point is detected from the crawled pages. No credential is ever submitted, no form is ever posted, and no account is ever tested.

A logout link is detected the same way, from the public HTML of pages already fetched.

Federated sign-in is detected from the OAuth or OpenID Connect flows the public pages reference — provider endpoints, client identifiers in redirect URLs, the standard parameters.

Token authentication is detected from public references to bearer tokens or JSON Web Tokens in the site's own scripts.

Multi-factor authentication is detected only from public mentions. There is no way to verify it is enforced from outside, and the check does not claim to.

An authenticated area means session cookies exist, and session cookies are the ones that must carry Secure, HttpOnly and a strict SameSite — which is a cookie review the same scan performs separately.

It means a credential-stuffing surface exists, and that a login endpoint without rate limiting is the cheapest way in.

It means user-specific responses exist, which is what makes the cache policy of an API a data-separation question rather than a performance one.

So the finding here is rarely actionable on its own. Its value is deciding which of the other findings matter for this particular site.

A login entry point on a known path, and a logout action reachable from wherever a session can exist. A missing logout is a session-hygiene gap that is easy to overlook in an interface that always assumes a signed-in user.

Federated sign-in where it fits, since it moves credential handling to a provider that does it full time. Redirect URIs allow-listed strictly on that provider's side.

Multi-factor availability documented publicly, which is both a control and a reason for a prospective customer to trust the product.

If tokens are used, short lifetimes and a storage choice that is not localStorage wherever a cookie would do.

Nothing behind the login is examined. No credential is submitted, so the authenticated application is entirely outside this scan.

MFA is read from public mentions only. A site that enforces it and says nothing looks identical to a site that does not offer it.

Absence of a detected login entry point does not prove there is none — it may live on an unlinked path, or on a separate hostname.

Token references in public scripts show the scheme in use; they say nothing about lifetime, rotation or storage.

`auth.login.public` and `auth.logout.public` detect the entry points in the crawled HTML. `auth.federation.signals` detects OAuth and OpenID Connect flows referenced publicly.

`auth.token.type` detects public references to bearer or JWT authentication. `auth.mfa.signals` looks for public mentions of MFA, two-factor or passkeys.

Every one of these is a detection with no interaction: the scan reads what the site already publishes.