Skip to content

Authentication Reference

AuthenticationConfigurationPresets

Authentication configuration model.

Property Type Default Description
$schema string null The schema of the configuration file
lifetime integer null The token max duration in seconds. Controls how often the token refresh is triggered. When set, Escape re-executes the authentication procedure at this frequency to obtain a fresh token before the token expiration date is reached. If not provided, the token is considered valid for the duration of the scan.
multi_user_is_fallback boolean false If true, the multi-user authentication will be interpreted as a list of fallback users when authenticating the first user failed.
presets List[BasicPreset,BrowserActionsPreset,BrowserAgentPreset,CognitoUserpassPreset,CurlPreset,CurlSequencePreset,DigestPreset,GraphQLPreset,HTTPPreset,HeadersPreset,OAuthAuthorizationCodeBrowserPreset,OAuthClientCredentialsPreset,OAuthROPCPreset] null A list of presets used to easily generate procedures and users automatically following common authentication standards
procedures List[Procedure] null The list of authentication procedures to rely on when authenticating users
proxy string null An optional global proxy used for all HTTP requests
users List[User] null List of users that multiauth will generate authentications for.
validation boolean null A flag to enable or disable the generated tokens validations. Set this to false to skip the validation. Set to true by default

Objects

AuthenticationVariable

Property Type Default Description
name* string The name of the variable
value* string The value of the variable

BasicPreset

The 'Basic' authentication preset is designed for straightforward authentication scenarios:

  • Credentials Encoding: User's credentials (username and password) are encoded in base64.
  • Header Attachment: The encoded credentials are attached to the request headers.
  • Authorization Header: The client sends these credentials in the Authorization header of the HTTP request.

This method provides a simple and direct way to authenticate users, without requiring additional server requests for user creation or authentication. It is best suited for scenarios where simplicity and ease of implementation are prioritized.

Note: While this method is straightforward, it's less secure compared to more advanced authentication methods.

Property Type Default Description
type* Const[basic] basic
users* List[BasicUserPreset] A list of users with basic credentials to create

BasicUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
password* string The Basic password of the user.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
username* string The Basic username of the user.

BrowserActionsOperation

It is a low-level operation that is used to interact with a browser.It is used to perform actions on a browser, such as clicking, filling, and checking.

Property Type Default Description
extractions* Union[BrowserExtraction,HTTPExtraction]
parameters* BrowserActionsOperationParameters The parameters of the operation.
tech* Const[browser_actions] browser_actions

BrowserActionsOperationParameters

Property Type Default Description
auto_extraction_urls List[string] null The API URLs to auto-extract requests headers from.Extracted headers will be injected automatically into every single authenticated request sent by the scanner.This is particularly useful when authentication API scans using Browser-based authentication.
logged_in_detector_text string null The text to detect in the last page to validate the user is logged in, case-insensitive
logged_in_detector_timeout integer 10 The timeout to wait for the logged in text to be detected (in seconds)
login_url* string The URL to perform the login on
logout_detection* BrowserLogoutDetectionConfig Configuration for automatic post-login logout detection during browser authentication.
proxy_override string null An optional proxy used for this specific request, else the global proxy will be used
stealth_mode boolean false If true, the browser will use stealth mode to avoid bot detection (and a potential CAPTCHA).

BrowserActionsPreset

The Browser Actions authentication preset is ideal for scenarios where Browser Agent authentication method falls short, as it leverages browser actions to perform login tasks. This preset is especially effective for form-based authentication where inputs are provided directly. Contrary to the Browser Agent preset, this preset does not use an AI Agent to perform the actions, but rather a browser automation actions based on Playwright actions and locators. By default, the preset automatically extracts cookies, localStorage andsessionStorage from the browser. If your scan is a Frontend scan, everything will be injected into the scanner's engine, to clone the browser behavior. If your scan is an API scan, only the cookies will be injected. If your authentication process stores credentials in local/session storage and you need to authenticate an API, be sure to configure the extractions and injections parameters accordingly.

Property Type Default Description
auto_extraction_urls List[string] null The API URLs to auto-extract requests headers from. Extracted headers will be injected automatically into every single authenticated request sent by the scanner. This is particularly useful when authentication API scans using Browser-based authentication. If left empty, the auto-extraction URLs are derived automatically from captured API traffic.
extractions List[BrowserExtraction] null The extractions used to extract from the browser like page, browser_local_storage, browser_session_storage, or browser_cookies.
injections Union[BrowserInjection,HTTPInjection] null The injection configuration used to inject the tokens into either the HTTP requests, or another browser for Frontend scans.
logged_in_detector_text string null The text to detect in the last page to validate the user is logged in, case-insensitive
logged_in_detector_timeout integer 10 The timeout to wait for the logged in text to be detected (in seconds)
login_url* string The url that presents the login form
logout_detection* BrowserLogoutDetectionConfig Configuration for automatic post-login logout detection during browser authentication.
stealth_mode boolean false If true, the browser will use stealth mode to avoid bot detection (and a potential CAPTCHA).
type* Const[browser_actions] browser_actions
users* List[BrowserActionsUserPreset] The list of users to generate tokens for.

BrowserActionsUserPreset

Property Type Default Description
actions* List[CheckAction,ClickAction,ClickMailMagicLinkAction,FillAction,FillMailTOTPAction,FillTOTPAction,FocusPageAction,GotoAction,SelectAction,SleepAction,SolveCaptchaAction,WaitElementAction,WaitTextAction] The actions to perform on the browser
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
username* string The username of the user.

BrowserAgentAgentic

Settings for the fully agentic browser login mode.

Property Type Default Description
enabled boolean false If true, login is driven by an agentic browser.
instructions string Optional natural-language guidance for the shared agentic login flow. Use it to describe special steps, alternate buttons, SSO branches, popups, or pages to avoid for every user of this operation. Do not include credentials in this field.

BrowserAgentOperation

An operation that authenticates in a browser either with deterministic form filling or, when parameters.agentic.enabled is true, with an agentic browser. Use parameters.agentic.instructions for shared guidance that applies to all users, and parameters.logout_detection.instructions to explain how to confirm the session stayed authenticated.

Property Type Default Description
extractions* Union[BrowserExtraction,HTTPExtraction]
parameters* BrowserAgentOperationParameters The parameters of the operation.
tech* Const[browser_agent] browser_agent

BrowserAgentOperationParameters

Property Type Default Description
agentic* BrowserAgentAgentic Configuration for the agentic browser login mode. When disabled, login uses deterministic form detection and automated input filling.
auto_extraction_urls List[string] null The API URLs to auto-extract requests headers from.Extracted headers will be injected automatically into every single authenticated request sent by the scanner.This is particularly useful when authentication API scans using Browser-based authentication.
logged_in_detector_text string null The text to detect in the last page to validate the user is logged in, case-insensitive
logged_in_detector_timeout integer 10 The timeout to wait for the logged in text to be detected (in seconds)
login_url* string The URL to perform the login on
logout_detection* BrowserLogoutDetectionConfig Configuration for automatic post-login logout detection during browser authentication.
proxy_override string null An optional proxy used for this specific request, else the global proxy will be used
stealth_mode boolean false If true, the browser will use stealth mode to avoid bot detection (and a potential CAPTCHA).

BrowserAgentPreset

The Browser Agent authentication preset is ideal for scenarios where traditional authentication methods fall short, as it leverages browser automation to perform login tasks. This preset is especially effective for frontend-based authentication where inputs are provided directly. By default, it uses deterministic input detection and automated field filling. If agentic.enabled is set to true, it switches to a fully agentic browser that drives the login flow with browser tools using the provided credentials, additional fields, and optional natural-language instructions. Use agentic.instructions for shared login guidance, users[].instructions for user-specific branches or post-login checks, and logout_detection.instructions to describe how Escape should recognize a successful logged-in state after authentication. By default, the preset automatically extracts cookies, localStorage and sessionStorage from the browser. If your scan is a Frontend scan, everything will be injected into the scanner's engine, to clone the browser behavior. If your scan is an API scan, only the cookies will be injected. If your authentication process stores credentials in local/session storage and you need to authenticate an API, be sure to configure the extractions and injections parameters accordingly.

Property Type Default Description
agentic* BrowserAgentAgentic Configuration for the agentic browser login mode. When disabled, authentication keeps using deterministic form detection and automated input filling.
auto_extraction_urls List[string] null The API URLs to auto-extract requests headers from. Extracted headers will be injected automatically into every single authenticated request sent by the scanner. This is particularly useful when authentication API scans using Browser-based authentication. If left empty, the auto-extraction URLs are derived automatically from captured API traffic.
extractions List[BrowserExtraction] null The extractions used to extract from the browser like page, browser_local_storage, browser_session_storage, or browser_cookies.
injections Union[BrowserInjection,HTTPInjection] null The injection configuration used to inject the tokens into either the HTTP requests, or another browser for Frontend scans.
logged_in_detector_text string null The text to detect in the last page to validate the user is logged in, case-insensitive
logged_in_detector_timeout integer 10 The timeout to wait for the logged in text to be detected (in seconds)
login_url* string The url that presents the login form
logout_detection* BrowserLogoutDetectionConfig Configuration for automatic post-login logout detection during browser authentication.
stealth_mode boolean false If true, the browser will use stealth mode to avoid bot detection (and a potential CAPTCHA).
type* Const[browser_agent] browser_agent
users* List[BrowserAgentUserPreset] The list of users to generate tokens for.

BrowserAgentPresetAdditionalFillAction

Property Type Default Description
auto_submit boolean false If true, the field will be submitted automatically after being filled
locator* string The locator that will be used to get the value of the field
one_by_one boolean false Whether the field should be filled one character by one character, like a TOTP code
value* string The value that will be used to set the field

BrowserAgentUserPreset

Per-user settings for browser-agent authentication.

Property Type Default Description
additional_fields* List[BrowserAgentPresetAdditionalFillAction] Additional fields to be used in the login form in the form selector:value
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
instructions string null Optional per-user natural-language guidance for the browser agent. Use it for role-specific prompts, post-login checks, user-specific popups, or branches that only affect this user. This field is especially useful when agentic.enabled is true.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
password* string The password that will be used to auto login
post_login_actions List[CheckAction,ClickAction,ClickMailMagicLinkAction,FillAction,FillMailTOTPAction,FillTOTPAction,FocusPageAction,GotoAction,SelectAction,SleepAction,SolveCaptchaAction,WaitElementAction,WaitTextAction] The actions to perform on the browser after the login
pre_login_actions List[CheckAction,ClickAction,ClickMailMagicLinkAction,FillAction,FillMailTOTPAction,FillTOTPAction,FocusPageAction,GotoAction,SelectAction,SleepAction,SolveCaptchaAction,WaitElementAction,WaitTextAction] null A list of actions to perform on the browser before the login. Useful for edge cases like accepting cookies, etc...
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
username* string The username or email that will be used to auto login

BrowserExtraction

Property Type Default Description
jq string null The jq expression to extract the value from the session storage item
key* string The key to use for the extracted value, depending on the location. In the case of Page location, this represents a Playwright selector
location* BrowserLocation The location of the browser where the value should be extracted.
name* string The name of the variable to store the extracted value into that will be used for injection
origin* string The URL of the page, origin of the local/session storage, or cookies where the value should be extracted.
regex string null The regex to use to extract the token from the key value. By default the entire value is taken.

BrowserInjection

Property Type Default Description
key* string The key to use for the injected token. Its usage depends on the location.
location* BrowserLocation The location of the browser where the token should be injected
origin* string The origin of the local storage or session storage where the token should be injected
variable* string The name of a variable to retrieve to create the token's value. If not provided, the token will be inferred as the first successful extraction of the procedure

BrowserLogoutDetectionConfig

Configuration for verifying that a browser login really resulted in an authenticated session.

Property Type Default Description
enabled boolean true If true, browser-based authentication will review the post-login page to detect logout or login failure.
instructions string Optional natural-language guidance for the post-login logout detection step. Use it to describe what a healthy logged-in state looks like, which redirects or dialogs are expected, and what signals should be treated as logout or login failure.

CheckAction

Property Type Default Description
action* Const[check] check
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
locator* string The Playwright Locator to select the checkbox to check
select_first_if_multiple boolean false Whether to select the first element if multiple elements are found. If false, an error will be raised.
timeout integer 30 Timeout in seconds for executing the check action

ClickAction

Property Type Default Description
action* Const[click] click
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
locator* string The Playwright Locator to select the element to click on
select_first_if_multiple boolean false Whether to select the first element if multiple elements are found. If false, an error will be raised.
timeout integer 30 Timeout in seconds for executing the click action

ClickMailMagicLinkAction

Property Type Default Description
action* Const[click_mail_magic_link] click_mail_magic_link
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
email_address* string The email address where the magic link will be sent.\nMust be a valid email address matching this pattern: {any_text}.{organization_id_short}@scan.escape.tech
new_page boolean false Whether to create a new page for the navigation or remain on the current page
timeout integer 60 The timeout (seconds) to wait for the page to load

CognitoUserpassPreset

The 'Cognito User Password' preset is designed for authentication using AWS Cognito with username and password credentials:

  • AWS Cognito Integration: Leverages AWS Cognito, a comprehensive user identity and data synchronization service, for authentication.
  • Regional Configuration: Allows specifying the AWS region where the Cognito service is hosted, ensuring proper routing and compliance with data residency requirements.
  • Client Credentials: Utilizes a client ID and client secret for secure OAuth requests within the Cognito framework.
  • User Authentication: Facilitates the creation and authentication of users with a username and password.

This preset is ideal for systems that use AWS Cognito for managing user authentication, providing a seamless integration with the AWS ecosystem.

Property Type Default Description
client_id* string The client ID to use for the OAuth requests
client_secret* string The client secret to use for the OAuth requests
region* AWSRegion The region of the Cognito Service.
type* Const[cognito_userpass] cognito_userpass
users* List[CognitoUserpassUserPreset] A list of users to create

CognitoUserpassUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
password* string The password of the user.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
scopes List[string] null A list of scopes to request for the user. If not specified, no scope will be requested.
username* string The username of the user.

Credentials

Property Type Default Description
actions List[CheckAction,ClickAction,ClickMailMagicLinkAction,FillAction,FillMailTOTPAction,FillTOTPAction,FocusPageAction,GotoAction,SelectAction,SleepAction,SolveCaptchaAction,WaitElementAction,WaitTextAction] null A list of actions to perform for the user when using Browser based authentication
basic string null The basic to attach to the HTTP requests sent for this user.
body object null A body to merge with the bodies of every HTTP requests sent for this user
cookies* List[HTTPCookie] A list of cookies to attach to every HTTP requests sent for this user
digest string null The digest to attach to the HTTP requests sent for this user.If your authentication looks like curl --digest -u user:password example.com, you can use this field to set the digest.In this example, the right value to set is user:password.
headers* List[HTTPHeader] A list of headers to attach to every HTTP requests sent for this user
local_storage Dict[string, Dict[string, string]] null A dictionary of origins and key values for a local storage to attach to the user when using Browser based authentication
password string null The password to attach to the HTTP requests sent for this user. See developer.mozilla.org
post_login_actions List[CheckAction,ClickAction,ClickMailMagicLinkAction,FillAction,FillMailTOTPAction,FillTOTPAction,FocusPageAction,GotoAction,SelectAction,SleepAction,SolveCaptchaAction,WaitElementAction,WaitTextAction] null A list of actions to perform on the browser after the login. Useful for edge cases like confirming login, creating a new session etc...
pre_login_actions List[CheckAction,ClickAction,ClickMailMagicLinkAction,FillAction,FillMailTOTPAction,FillTOTPAction,FocusPageAction,GotoAction,SelectAction,SleepAction,SolveCaptchaAction,WaitElementAction,WaitTextAction] null A list of actions to perform on the browser before the login. Useful for edge cases like accepting cookies, etc...
query_parameters* List[HTTPQueryParameter] A list of query parameters to attach to every HTTP requests sent for this user
session_storage Dict[string, Dict[string, string]] null A dictionary of origins and key values for a session storage to attach to the user when using Browser based authentication
username string null The username to attach to the HTTP requests sent for this user. See developer.mozilla.org

CurlPreset

The cURL authentication preset is designed for dynamic token generation and reuse:

  • cURL Command Parsing: Parses a cURL command and executes it in a secure sandboxed cURL simulator.
  • Dynamic Token Extraction: Extracts the authentication token from the cURL command's HTTP response.
  • Token Re-injection: Reinjects the extracted token into subsequent authenticated requests.

This preset is particularly useful for scenarios where authentication tokens are dynamically generated and need to be efficiently extracted and reused in ongoing requests.

The simulator supports a subset of arguments commonly used in cURL:

  • url: The URL for the HTTP request.
  • -X, --request: Specify a custom request method to use when communicating with the HTTP server.
  • -H, --header: Add a header to the request (can be used multiple times for multiple headers).
  • -b, --cookie: Add a cookie to the request (can be used multiple times for multiple cookies).
  • -d, --data, --data-ascii, --data-binary, --data-raw: Sends the specified data in a POST request.
  • -u, --user: Specify the user and password for server authentication.
  • -A, --user-agent: Sets the user agent string for the HTTP request.
  • -x, --proxy: Use the specified proxy.
  • -k, --insecure: Allow connections to SSL sites without certificates.
  • -L, --location: Follow redirects (the maximum number of redirects is defined by --max-redirs).
  • --max-redirs: Set the maximum number of redirections to follow for -L.

Note: The simulator does not support all cURL arguments. Adding unsupported arguments may result in an error.

Property Type Default Description
extractions* List[HTTPExtraction] The token extraction configuration used to extract the tokens from the HTTP response.
injections* List[HTTPInjection] The injection configuration used to inject the tokens into the HTTP requests.
type* Const[curl] curl
users* List[CurlUserPreset] The list of users to generate tokens for.

CurlSequencePreset

The cURL Sequence authentication preset facilitates complex authentication flows by executing a templated sequence of cURL requests in a secure sandboxed cURL simulator:

  • Templated cURL Requests: Enables the definition of a sequence of cURL requests, where each request can be templated with variables.
  • Dynamic Token Extractions: Variables are dynamically extracted from the responses of these requests, allowing for sequential data dependency across requests.
  • Token Re-injection: Extracted tokens or variables can be reinjected into subsequent authenticated requests.
  • User-Specific Variables: Supports defining user-specific variables that can be injected into the cURL sequences.

This preset is particularly useful for complex authentication scenarios where multiple steps or interactions are required, and where each step might depend on the outcome of the previous one.

Warning: This preset requires to name your variables in order to be able to extract and inject them properly in the templates or the final injections.

The simulator supports a subset of arguments commonly used in cURL:

  • url: The URL for the HTTP request.
  • -X, --request: Specify a custom request method to use when communicating with the HTTP server.
  • -H, --header: Add a header to the request (can be used multiple times for multiple headers).
  • -b, --cookie: Add a cookie to the request (can be used multiple times for multiple cookies).
  • -d, --data, --data-ascii, --data-binary, --data-raw: Sends the specified data in a POST request.
  • -u, --user: Specify the user and password for server authentication.
  • -A, --user-agent: Sets the user agent string for the HTTP request.
  • -x, --proxy: Use the specified proxy.
  • -k, --insecure: Allow connections to SSL sites without certificates.
  • -L, --location: Follow redirects (the maximum number of redirects is defined by --max-redirs).
  • --max-redirs: Set the maximum number of redirections to follow for -L.

Note: The simulator does not support all cURL arguments. Adding unsupported arguments may result in an error.

Property Type Default Description
injections List[HTTPInjection] null Final variables injected into the authenticated requests.
requests* List[CurlSequenceRequestPreset] A sequence of curl templates used to make requests and extract variables.
type* Const[curl_sequence] curl_sequence
users* List[CurlSequenceUserPreset] The list of users to generate tokens for.

CurlSequenceRequestPreset

Property Type Default Description
curl* string A curl template used to make a request.
extractions List[HTTPExtraction] null Variables extracted from the response that can be templated in further requests.

CurlSequenceUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
username* string The arbitrary name that identifies the user.
variables Dict[string, string] null A dict of variables to inject into the cURL sequences.

CurlUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
curl* string The curl command that is used to fetch the tokens for this user.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
username* string The arbitrary name that identifies the user.

DigestPreset

The Digest authentication preset implements HTTP Digest authentication.

The supported authentication method is curl --digest -u user:password example.com. In this example, the username is user and the password is password.

Property Type Default Description
type* Const[digest] digest
users* List[DigestUserPreset] A list of users with digest credentials to create

DigestUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
password* string The Digest password of the user.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
username* string The Digest username of the user.

FillAction

Property Type Default Description
action* Const[fill] fill
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
auto_submit boolean false Whether the form should be automatically submitted after the fill action
locator* string The Playwright Locator to select the field to fill
one_by_one boolean false Whether the field should be typed one character by one character, like a TOTP code
select_first_if_multiple boolean false Whether to select the first element if multiple elements are found. If false, an error will be raised.
timeout integer 30 Timeout in seconds for executing the input filling action
value* string The value to fill in the field

FillMailTOTPAction

Property Type Default Description
action* Const[fill_mail_totp] fill_mail_totp
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
auto_submit boolean false Whether the form should be automatically submitted after the fill action
email_address* string The email address where the TOTP code will be sent.\nMust be a valid email address matching this pattern: {any_text}.{organization_id_short}@scan.escape.tech
locator* string The Playwright Locator to select the field to fill
one_by_one boolean false Whether the field should be typed one character by one character, like a TOTP code
select_first_if_multiple boolean false Whether to select the first element if multiple elements are found. If false, an error will be raised.
timeout integer 30 Timeout in seconds for executing the input filling action

FillTOTPAction

Property Type Default Description
action* Const[fill_totp] fill_totp
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
auto_submit boolean false Whether the form should be automatically submitted after the TOTP code is filled
locator* string The Playwright Locator to select the field to fill the TOTP code in
secret* string The secret to generate the TOTP code from

FocusPageAction

Property Type Default Description
action* Const[focus_page] focus_page
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
url_pattern* string The pattern to find in the URL to focus on a page. Should be a regex allowing to match the page using Python re.findall().

GotoAction

Property Type Default Description
action* Const[goto] goto
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
new_page boolean false Whether to create a new page for the navigation or remain on the current page
timeout integer 60 The timeout (seconds) to wait for the page to load
url* string The URL to navigate to

GraphQLPreset

The 'GraphQL' authentication preset facilitates authentication through GraphQL queries:

  • GraphQL Endpoint: The authentication is performed against a specified GraphQL endpoint.
  • Query Templating: Utilizes a templated GraphQL query for authentication requests.
  • Variable Handling: User credentials are passed as variables within the GraphQL query.
  • Token Extraction: Specifies how and where to extract authentication tokens (e.g., from the response body).
  • Token Injection: Defines how to inject the extracted token into subsequent requests.

This preset is ideal for systems where authentication is managed via GraphQL APIs, allowing for flexible and powerful authentication mechanisms.

Property Type Default Description
extractions List[HTTPExtraction] The extractions of the GraphQL query containing the user credentials.
injections List[HTTPInjection] The injections of the GraphQL query containing the user credentials.
query* string The templated GraphQL inside the query field of the JSON body of the HTTP request.
type* Const[graphql] graphql
url* string The URL of the GraphQL authentication endpoint.
users* List[GraphQLUserPreset] A list of users with credentials contained in the GraphQL variables of the query

GraphQLUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
username* string The name of the user.
variables* Dict[string, string] The variables of the GraphQL query containing the user credentials.

HTTPCookie

Property Type Default Description
domain string null
http_only boolean null
name* string
path string null
same_site string null
secure boolean null
values* List[string]

HTTPExtraction

Property Type Default Description
key* string The key to use for the extracted value, depending on the location
location* HTTPLocation The location of the HTTP request where the value should be extracted
name* string The name of the variable to store the extracted value into
regex string null The regex to use to extract the token from the key value. By default the entire value is taken.

HTTPHeader

Property Type Default Description
name* string
values* List[string]

HTTPInjection

Property Type Default Description
key* string The key to use for the injected token. Its usage depends on the location. For headers, cookies,and query parameters, this key describes the name of the header, cookie or query parameter. For a body location, the key is the field where the token should be injected within the request bodies
location* HTTPLocation The location of the HTTP request where the token should be injected
prefix string null A prefix to prepend to the token before it is injected
variable* string The name of a variable to retrieve to create the token's value. If not provided, the token will be inferred as the first successful extraction of the procedure

HTTPOperation

The 'HTTP Request' operation is used to send an HTTP request to a given URL. It is a versatile operation that can be used to interact with any HTTP-based API or service.

Property Type Default Description
extractions* List[HTTPExtraction] The list of extractions to run at the end of the operation.For HTTP operations, variables are extracted from the response.
parameters* HTTPRequestParameters The parameters of the HTTP request to send. At least a URL and a method must be provided.
tech* Const[http] http

HTTPPreset

The 'HTTP' authentication preset is designed to handle authentication via structured HTTP requests:

  • Structured Request: Authentication is performed through a well-defined HTTP request, including URL, method, headers, cookies, query parameters, and body.
  • Dynamic Token Management: The preset handles the extraction of authentication tokens from the HTTP response and subsequently reinjects them into future requests.
  • User Credentials: Supports attaching various credentials to each user, such as username, password, headers, cookies, and other request parameters.

This method is particularly effective in scenarios where authentication is managed via custom HTTP endpoints, requiring precise control over request composition and token handling.

Property Type Default Description
extractions* List[HTTPExtraction] The token extraction configuration used to extract the tokens from the HTTP response.
injections* List[HTTPInjection] The injection configuration used to inject the tokens into the HTTP requests.
request* HTTPRequestPreset The parameters of the HTTP request used to fetch the access and refresh tokens.
type* Const[http] http
users* List[HTTPUserPreset] The list of users to generate tokens for.

HTTPQueryParameter

Property Type Default Description
name* string
values* List[string]

HTTPRequestParameters

Property Type Default Description
body object null The body of the request. It can be a string or a JSON object. It is merged with the user credentials body if provided. If bodies of the HTTP request and of the user credentials are both JSON objects, they are merged. If the two bodies are strings, they are concatenated. If the two bodies are of different types, the body of the user credentials is used instead of this value.
cookies* List[HTTPCookie] The list of cookies to attach to the request. Cookies are merged with the user credentials cookies. It is possible to attach multiple values to a cookie. Cookie values are url-encoded before being sent.
follow_redirects integer null The number of redirects to follow
headers* List[HTTPHeader] The list of headers to attach to the request. Headers are merged with the user credentials headers. It is possible to attach multiple values to a header.
insecure boolean null If the SSL certificate should be verified
method HTTPMethod POST The HTTP method to use
proxy_override string null An optional proxy used for this specific request, else the global proxy will be used
queryParameters* List[HTTPQueryParameter] The list of query parameters to attach to the request. Query parameters are merged with the user credentials query parameters. It is possible to attach multiple values to a query parameter. Query parameter values are url-encoded before being sent.
timeout integer null The timeout of the request in seconds
url* string The URL to send the request to

HTTPRequestPreset

Property Type Default Description
body object null The body of the request. It can be a string or a JSON object. It is merged with the user credentials body if provided. If bodies of the HTTP request and of the user credentials are both JSON objects, they are merged. If the two bodies are strings, they are concatenated. If the two bodies are of different types, the body of the user credentials is used instead of this value.
cookies Dict[string, string] The list of cookies to attach to the request. Cookies are merged with the user credentials cookies. It is possible to attach multiple values to a cookie. Cookie values are url-encoded before being sent.
headers Dict[string, string] The list of headers to attach to the request. Headers are merged with the user credentials headers. It is possible to attach multiple values to a header.
method HTTPMethod POST The HTTP method to use
query_parameters Dict[string, string] The list of query parameters to attach to the request. Query parameters are merged with the user credentials query parameters. It is possible to attach multiple values to a query parameter. Query parameter values are url-encoded before being sent.
url* string The URL to send the request to

HTTPUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
body object null A body to merge with the bodies of every HTTP requests sent for this user
cookies Dict[string, string] A dict representing the cookies to attach to every HTTP requests sent for this user
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] A dict representing the headers to attach to every HTTP requests sent for this user
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
password string null The password to attach to the HTTP requests sent for this user. See developer.mozilla.org
queryParameters Dict[string, string] A dict of query parameters to attach to every HTTP requests sent for this user
role string null The role of the user (e.g., admin, user).
username* string The username to attach to the HTTP requests sent for this user. See developer.mozilla.org

HeadersPreset

The 'Headers' authentication preset is a straightforward, manual authentication method:

  • Manual Token Injection: Authentication is achieved by manually injecting tokens or credentials into the request headers. No authentication request is necessary.
  • Static Credentials: User credentials are static and defined in advance, making setup simple.
  • Optional Cookies: Cookies can be injected as well, directly encoded in the Cookie header or one by one in the cookies key.
  • Token Expiry Consideration: A key aspect to consider is that since tokens are manually set, they may expire, necessitating regular manual updates to maintain access.

This preset is ideal for scenarios where authentication can be handled via predefined headers, but users should be mindful of the need to regularly update tokens or credentials to avoid access issues.

Property Type Default Description
type* Const[headers] headers
users* List[HeadersUserPreset] A list of users with basic credentials to create

HeadersUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers* Dict[string, string] The headers of the user.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
username* string The name of the user.

OAuthAuthorizationCodeBrowserOperation

The OAuth Authorization Code operation handles the complete OAuth 2.0 Authorization Code flow. It automatically navigates to the authorization server, fills in user credentials, handles the redirect with authorization code, and exchanges the code for access tokens.

Property Type Default Description
extractions* Union[BrowserExtraction,HTTPExtraction]
parameters* OAuthAuthorizationCodeBrowserOperationParameters
tech* Const[oauth_authz_code_browser] oauth_authz_code_browser

OAuthAuthorizationCodeBrowserOperationParameters

Property Type Default Description
authorization_url* string The OAuth 2.0 authorization endpoint URL with all necessary query parameters
auto_extraction_urls List[string] null The API URLs to auto-extract requests headers from.Extracted headers will be injected automatically into every single authenticated request sent by the scanner.This is particularly useful when authentication API scans using Browser-based authentication.
client_id* string OAuth client ID
client_secret* string OAuth client secret
logged_in_detector_text string null The text to detect in the last page to validate the user is logged in, case-insensitive
logged_in_detector_timeout integer 10 The timeout to wait for the logged in text to be detected (in seconds)
login_timeout integer 30 Timeout for the login process in seconds
login_url* string The URL to perform the login on
logout_detection* BrowserLogoutDetectionConfig Configuration for automatic post-login logout detection during browser authentication.
proxy_override string null An optional proxy used for this specific request, else the global proxy will be used
redirect_uri* string The redirect URI to monitor for authorization codes
stealth_mode boolean false If true, the browser will use stealth mode to avoid bot detection (and a potential CAPTCHA).
token_url* string The OAuth 2.0 token endpoint URL for exchanging authorization codes
use_pkce boolean true Whether to use PKCE for enhanced security

OAuthAuthorizationCodeBrowserPreset

The 'OAuth Authorization Code Browser' preset implements the OAuth 2.0 Authorization Code grant type (RFC 6749, Section 4.1):

  • Authorization Endpoint: Users are automatically redirected to the OAuth provider's authorization server where they authenticate.
  • Browser Automation: The system automatically fills in user credentials and handles the authorization flow without user interaction.
  • Code Exchange: Authorization codes are automatically extracted from the redirect URI and exchanged for access tokens.
  • PKCE Support: Implements Proof Key for Code Exchange (RFC 7636) for enhanced security by default.
  • Token Management: Automatically handles access tokens and refresh tokens, injecting Bearer tokens into authenticated requests.

Performance Note: This authentication method requires browser automation to handle the interactive authorization flow, making it less efficient than API-only methods like OAuth Client Credentials or Resource Owner Password Credentials that use only programmatic HTTP requests. Use this method when the OAuth provider requires user interaction or when maximum security is needed.

Security: This flow is the most secure OAuth 2.0 grant type as it never exposes user credentials to the client application and includes PKCE protection against authorization code interception attacks.

Use Cases: Ideal for web applications, mobile apps, and any scenario where you need to authenticate users through third-party OAuth providers (Google, GitHub, Auth0, etc.) while maintaining the highest security standards.

Property Type Default Description
authorization_url* string The URL of the OAuth 2.0 authorization endpoint where users will be redirected to login
client_id* string The client ID to use for the OAuth requests
client_secret* string The client secret to use for the OAuth requests
login_timeout integer 30 Timeout in seconds to wait for the login process to complete
logout_detection* BrowserLogoutDetectionConfig Configuration for automatic post-login logout detection during browser authentication.
redirect_uri* string The redirect URI registered with the OAuth provider. The authorization code will be extracted from this callback.
scopes List[string] null Default scopes to request. Can be overridden per user.
token_url* string The URL of the OAuth 2.0 token endpoint to exchange authorization codes for tokens
type* Const[oauth_authz_code_browser] oauth_authz_code_browser
use_pkce boolean true Whether to use PKCE (Proof Key for Code Exchange) for enhanced security. Recommended for public clients.
users* List[OAuthAuthorizationCodeBrowserUserPreset] A list of users to authenticate

OAuthAuthorizationCodeBrowserUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
password* string The password of the user for the authorization server.
post_login_actions List[CheckAction,ClickAction,ClickMailMagicLinkAction,FillAction,FillMailTOTPAction,FillTOTPAction,FocusPageAction,GotoAction,SelectAction,SleepAction,SolveCaptchaAction,WaitElementAction,WaitTextAction] A list of actions to perform on the browser after the login.
pre_login_actions List[CheckAction,ClickAction,ClickMailMagicLinkAction,FillAction,FillMailTOTPAction,FillTOTPAction,FocusPageAction,GotoAction,SelectAction,SleepAction,SolveCaptchaAction,WaitElementAction,WaitTextAction] null A list of actions to perform on the browser before the login. Useful for edge cases like accepting cookies, etc...
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
scopes List[string] null A list of scopes to request for the user. If not specified, no scope will be requested.
username* string The username of the user.

OAuthClientCredentialsPreset

The 'OAuth Client Credentials' preset is tailored for authentication using the OAuth 2.0 client credentials grant, ideal for service accounts:

  • OAuth Token Endpoint: Directs authentication requests to the token endpoint of an OpenID Connect server.
  • Service Account Credentials: Utilizes client IDs and secrets to authenticate, representing service accounts rather than individual end-users.
  • Token Generation: Designed to obtain access tokens for service accounts without the need for a user's password.

This preset is particularly effective for scenarios where applications or services themselves need to authenticate, independent of a user's direct involvement.

Property Type Default Description
type* Const[oauth_client_credentials] oauth_client_credentials
url* string The URL of the token endpoint of the OpenIDConnect server
users* List[OAuthClientCredentialsUserPreset] A list of users to create

OAuthClientCredentialsUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
audience string null The audience to request for the user. If not specified, no audience will be requested.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
basic_style boolean false Whether to use the basic style of authentication where client_id and client_secret are encoded in the Authorization header.
client_id* string The client ID to use for the OAuth requests
client_secret* string The client secret to use for the OAuth requests
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
scopes List[string] null A list of scopes to request for the user. If not specified, no scope will be requested.
username* string The arbitrary username given to the user.

OAuthROPCPreset

The 'OAuth Resource Owner Password Credentials' preset implements the OAuth 2.0 Resource Owner Password Credentials grant type (RFC 6749, Section 4.3):

  • Token Endpoint: Authentication requests are sent to the OAuth 2.0 authorization server's token endpoint to exchange user credentials for access tokens.
  • Client Authentication: Uses client ID and client secret to authenticate the OAuth client application with the authorization server.
  • Resource Owner Credentials: Directly uses the resource owner's (user's) username and password to obtain access tokens, bypassing the typical authorization code flow.
  • Scope Support: Optional scope parameters can be included to request specific access permissions.

Important: This grant type should only be used when there is a high degree of trust between the resource owner and the client (e.g., first-party applications), as it involves handling user passwords directly. RFC 6749 recommends this flow only when other OAuth flows are not viable.

Property Type Default Description
client_id* string The client ID to use for the OAuth requests
client_secret* string The client secret to use for the OAuth requests
type* Const[oauth_ropc] oauth_ropc
url* string The URL of the token endpoint of the OpenIDConnect server
users* List[OAuthROPCUserPreset] A list of users to create

OAuthROPCUserPreset

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
basic string null The basic to attach Reach the Login Page and attack to the HTTP requests sent for this user.
cookies Dict[string, string] null Optional cookies injected during the authentication process and in authenticated requests.
digest string null The digest to attach Reach the Login Page and attack to the HTTP requests sent for this user.
headers Dict[string, string] null Optional headers injected during the authentication process and in authenticated requests.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
password* string The password of the user.
query_parameters Dict[string, string] null Optional query parameters injected during the authentication process and in authenticated requests.
role string null The role of the user (e.g., admin, user).
scopes List[string] null A list of scopes to request for the user. If not specified, no scope will be requested.
username* string The username of the user.

Procedure

Property Type Default Description
injections* Union[BrowserInjection,HTTPInjection] The list of injections to perform at the end of the procedure. Injections are used to inject the variables extracted from the procedure into the user authentication.
name* string The name of the procedure. It must be unique and is used to reference the procedure in users.
operations* List[BrowserActionsOperation,BrowserAgentOperation,HTTPOperation,OAuthAuthorizationCodeBrowserOperation] The list of operations executed during the procedure. An operation is a unit transaction, like an HTTP request, or a Playwright autologin script. Operations are ordered, and the variables extracted from an operation can be used in the next operations.

SelectAction

Property Type Default Description
action* Const[select] select
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
locator* string The Playwright Locator to select the dropdown to select from
select_first_if_multiple boolean false Whether to select the first element if multiple elements are found. If false, an error will be raised.
timeout integer 30 Timeout in seconds for executing the click action
value* string The value to select

SleepAction

Property Type Default Description
action* Const[sleep] sleep
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
seconds* number The time to sleep in seconds, between 0 and 40 seconds

SolveCaptchaAction

Property Type Default Description
action* Const[solve_captcha] solve_captcha
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
auto_submit boolean false Whether the form should be automatically submitted after the captcha is filled
locator* string The Playwright Locator to select the captcha field to fill

User

Property Type Default Description
allow_failure boolean false If false, authentication failure for this user will fail the scan. Ignored for the main user: failures for main user are always fatal.
credentials Credentials null A set of HTTP parameters used to customize requests sent for the user.
main_user boolean false When running a WebApp Testing scan, this indicates that the scanner must use this user when crawling. There must be only one main user per scan. If none is provided, a random user will be selected.
name* string The name of the user
procedure string null The name of the procedure to use to authenticate the user.This name MUST match the name field of a procedure in the procedures list in the multiauth configuration.
role string null The role of the user (e.g., admin, user).
user_instructions string null Optional per-user instructions forwarded to browser-based authentication flows. Use this field for user-specific hints, popups, or post-login checks when the selected procedure authenticates in a browser.
variables* List[AuthenticationVariable] List of variables that will be injected at the beginning of the user's authentication procedure.

WaitElementAction

Property Type Default Description
action* Const[wait_element] wait_element
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
locator* string The selector to wait for
timeout number 10 The timeout (seconds) to wait for the element to be visible

WaitTextAction

Property Type Default Description
action* Const[wait_text] wait_text
allow_failure boolean false Allow this action to fail without breaking authentication, defaults to False.
timeout number 10 The timeout (seconds) to wait for the text to be visible
value* string The text to wait for until visible, case-insensitive

Enums

AWSRegion

Value
us-east-2
us-east-1
us-west-1
us-west-2
af-south-1
ap-east-1
ap-south-1
ap-northeast-3
ap-northeast-2
ap-southeast-1
ap-southeast-2
ap-northeast-1
ca-central-1
cn-north-1
cn-northwest-1
eu-central-1
eu-west-1
eu-west-2
eu-south-1
eu-west-3
eu-north-1
me-south-1
sa-east-1

BrowserLocation

Value
page
browser_local_storage
browser_session_storage
browser_cookies

HTTPLocation

Value
header
cookie
body
query

HTTPMethod

Value
CONNECT
DELETE
GET
HEAD
OPTIONS
PATCH
POST
PUT
TRACE