TOC & Recently Viewed

Recently Viewed Topics

Cookie Authentication

These steps describe how to check the authentication values for the Cookie Authentication option in the Credentials settings for the Web App Overview and Web App Scan templates.

These steps assume that you already have a cookie authentication form ready to test your credentials.

To test your authentication values:

  1. For the web application you want to scan, access the cookie authentication page.

  2. Type your credentials.

    cookie authentication test page

  3. Upon successful authentication, in the browser console, locate the call that performs the authentication. In this example, the call is login.

    The Cookies tab displays one or more key/value pairs. In this example, the pair is was-session and

    cookie authentication console

To run a credentialed scan with cookie authentication:

  1. In Web Application Scanning, either create a new scan, or access the scan settings for which you want to add credentials.
  2. In the scan settings, click the Credentials tab.
  3. Click Web Application Authentication.
  4. In the Authentication Method drop-down box, select Cookie Authentication.
  5. In the Session Cookies text box, type the key/value pairs that you retrieved in step 3 of To test your authentication values.
  6. In the Page to verify active session text box, type the URL you want to use to verify if the session is still active.
  7. In the Regex to verify active session text box, type the regex to match to confirm the session is still active.

    Note: In many cases, the regex is text that appears on the login page (e.g., Welcome!)

  8. Click Save.

    When you launch the scan, the Cookie Authentication Succeeded plugin appears in the scan results.

    cookie authentication succeeded plugin

    If the Cookie Authentication Failed plugin appears, the output indicates the reason for the failure.

    If the page did not authenticate successfully, there is an issue with the cookies sent to the scan.

    If the page did authenticate successfully, there may be an issue with the regex you defined.

    cookie authentication failed plugin

Copyright © 2019 Tenable, Inc. All rights reserved. Tenable,, Tenable Network Security, Nessus, SecurityCenter, SecurityCenter Continuous View and Log Correlation Engine are registered trademarks of Tenable, Inc.., Lumin, Assure, and the Cyber Exposure Company are trademarks of Tenable, Inc. All other products or services are trademarks of their respective owners.