nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Pentest discussion: Checking authentication across subdomains

AdminUser

Seeded test discussion. How would you validate checking authentication across subdomains in an authorized engagement?

Scenario: Test approved subdomains with test accounts to verify intended SSO behavior and cookie boundaries. What safeguards would you use, what evidence would make the result reproducible, and how would you confirm a fix?

Comments

AdminUser

Testing approach: Test approved subdomains with test accounts to verify intended SSO behavior and cookie boundaries. Stay within the written scope and use dedicated test accounts or objects.

AdminUser

Evidence: Record each hostname, cookie scope, redirect path, and resulting identity. Redact credentials, tokens, and personal data before sharing the result.

AdminUser

Fix and retest: Avoid overly broad cookies and validate redirect destinations. Repeat the original check after deployment and record the outcome.