pafcore.site

Pages behind a login

Most of the slow pages in an app are the ones a stranger never sees. Watch can measure those.

You give us one session from your own browser. Not a password.

How to set it up

  1. Prove you control the domain, the same way monitors do. We refuse a session for a host you have not proven.
  2. Open the page you want measured, signed in as you normally are.
  3. Open your browser's developer tools, go to the Network tab, right click the request for that page and choose Copy as cURL.
  4. Paste that into the box. It already contains the session. We take the part we asked for and throw the rest away.
  5. We tell you what we understood from the paste before you save it, and we test the session the moment you do.

The test after you save

Three answers, not two:

  • It worked. We reached the page as a signed-in user.
  • It did not work. We were sent to a login page.
  • We cannot tell. The page loaded but we could not confirm you were signed in. This is a real outcome. Printing it as a failure would send you off to replace a session that is fine.

What we do with it

It is encrypted before it is stored. You never see the whole thing again, only its length and the last few characters, so you can tell which one it is.

It is sent to that one host and nowhere else. We attach it inside our own network layer rather than handing it to the browser, which means every redirect is checked and the session is dropped the moment the address stops being the host it belongs to. Handing it to the browser would keep sending it after a redirect, and that is how a session leaks.

Revoke removes it. The next run goes back to being signed out.

Adding and revoking are both written to an audit log on your account.

What we refuse

  • A session for a host you have not proven.
  • A URL with a username and password in it.
  • Driving a login form for you. That means storing a password rather than a session you can revoke, so it is not something we will build.

A word of advice

Use a throwaway account where you can. Nothing here needs your own admin login, and a session you can burn is easier to revoke than one you rely on.