Authentication - Server Records
In this page, select records that are used to authenticate against web server.
Record Information
- Send authentication over SSL only: Select check box if you want our service to attempt authentication only when the form being authenticated to will be sent over SSL. When selected, authentication is attempted only when the form is submitted via a link that uses SSL (link URI https://...).
- This site requires a client certificate: Select check box if the web application requires a client certificate. Click browse to select and upload a certificate from your local file system, or drag and drop the file into the window. Upon successful upload, click View to view the certificate contents.
- Passphrase: If required, enter and confirm a passphrase for the certificate.
Credentials
Enter server authentication credentials in the record.
- Basic Record: Select to add a Basic record. Then enter the realm and login credentials in the fields provided. The realm is a name associated with the protected area of the web application. It corresponds to the AuthName setting in a .htaccess file for Apache servers, and to the Realm value set for IIS servers.
- Digest Record: Select to add a Digest record. Then enter the realm and login credentials in the fields provided. The realm is a name associated with the protected area of the web application. It corresponds to the AuthName setting in a .htaccess file for Apache servers, and to the Realm value set for IIS servers.
- NTLM Record: Select to add an NTLM record. Then enter login credentials in the fields provided.
- Realm (optional): For NTLM server authentication, enter the Windows domain name containing the credentials supplied in User Name/Password. For HTTP Basic server authentication, enter the protected realm name. You can enter a maximum of 128 characters.
- Username: Enter a username for authentication. You can enter a maximum of 128 characters.
- Password: Enter a password for authentication.
Does Your Application Require Server Authentication?
Server authentication is requested through a browser-native sign-in pop-up that appears before the application itself loads — this is different from a login form that is part of the page. If your application shows this kind of pop-up, you need to configure a server record in the authentication record.
To confirm which type of server authentication is required, open your browser's developer tools, mostly this will be Basic or NTLM. Select the Basic, Digest, or NTLM record that matches the scheme named in this header.
Combining Server Authentication with Form or Selenium Authentication
Server authentication is usually configured alongside a Standard Login, Custom, or Selenium Script record in the same authentication record, rather than on its own, since the server-level prompt and the application's own login form are independent layers. See Authentication - Web Application to configure the form or Selenium layer in the same record.
Verifying Server Authentication
If server authentication succeeds but the form-based or Selenium authentication configured in the same record fails, the scan details report the Authentication Status as Partial.
Best Practices
- Select Send authentication over SSL only when the application should be reached over HTTPS, so credentials are never sent over an unencrypted connection by mistake.
- Add the server record to the same authentication record as your Standard Login, Custom, or Selenium Script configuration instead of creating a separate record for it, so both layers are evaluated together during the scan.
- If a scan reports a Partial authentication status, check the server record and the form/Selenium record independently rather than assuming the whole authentication record is misconfigured.