Most of an application's functionality, and most of its risk, sits behind the login page. A scanner that cannot log in only tests the public surface and misses account pages, admin areas and most APIs.

How it works

For an authenticated scan, the scanner needs a way to log in (a form login, a recorded login flow, or a token) and a way to notice when it has been logged out. Without that, a scan often starts logged in, logs itself out by visiting a logout link, and then quietly tests only the login page.

Why it matters

• Unauthenticated scans typically see only a fraction of an application.
• Access-control flaws such as IDOR can only be found when logged in.
• Reports from logged-out scans give false confidence.

Best practices

• Use a dedicated test account for each role you want to test.
• Exclude logout links and destructive actions from the scan scope.
• Configure session detection and automatic re-login.
• Check the scan coverage after each run: how many URLs were actually reached?

How Vooki Pro helps

• Auth profiles support form login (including CSRF tokens), recorded browser logins and token-based API authentication.
• Automatic re-login keeps the session alive during long scans.
• Warns you when the scan's session looks invalid, so a logged-out scan never looks like a clean result.
• Shows scan coverage (requests scanned and URLs discovered) on every scan's Overview tab.

Frequently asked questions

Why do unauthenticated scans miss vulnerabilities?

Most functionality is behind the login, so an unauthenticated scan only sees the public pages.

How do I stop the scanner logging itself out?

Exclude logout links from scope and use a scanner with session detection and automatic re-login.

Related: DAST vs SAST vs penetration testing: which do you need? · Scanning single-page applications (React, Angular, Vue)