Authentication and access control

HTTP auth challenges, cookie-gated content, expired sessions, SameSite scoping, login surfaces, and redirect-to-login flows.

Fixtures that let a crawler distinguish the common ways sites gate content: 401 challenges (Basic and Digest), 403 forbidden without a challenge, cookie set/read gating, expired sessions, SameSite=Strict cross-site cookie scoping, visible login forms, and redirect-to-login bounces.

These are fixtures of auth behaviour, not real security. Every credentialed fixture accepts exactly one documented, intentionally public credential pair:

username: crawler
password: Sitebulb-Crawler-Test-2026

These values grant access to nothing except fixture content on this test site. They are published here precisely so crawlers can be configured with them. Never reuse this pair for anything that protects real data.

Every cookie set by this group is path-scoped to /tests/auth/. No route outside this group is ever gated, redirected, or altered by these fixtures; a crawler that never visits this group sees zero auth behaviour.

Families:

• Basic authentication: a 401 challenge route and a success route, both sharing one credential check against the documented pair.
• Digest authentication: challenge-only — a deterministic 401 Digest challenge that never grants access.
• Cookies and sessions: a cookie setter, cookie-gated content, an expired-session route, and a SameSite=Strict proof with its cross-origin helper.
• Forbidden: a plain 403 with no challenge header, distinguishing forbidden-without-challenge from the 401 fixtures.
• Login surface: a visible login form, a robots-accessible variant, a noindexed variant, and an unconditional redirect-to-login.
• IP-based access: a reference page pointing at the fingerprinting profile; the primary site never gates on IP or fingerprint signals.

Only the robots-accessible login form and the IP reference page appear in the default sitemap. Every credentialed or gated route is a direct-entry fixture in the safe manifest, never listed in any sitemap.

Fixtures in this category

• Session cookie setter — auth-cookie-setter (safe)
• HTTP 403 forbidden without challenge — auth-403-forbidden (safe)
• Visible login form — auth-login-form-visible (safe)
• Redirect to login — auth-redirect-to-login (safe)
• Robots-accessible login form — auth-robots-accessible-login (safe)
• Noindexed login form — auth-noindex-login-page (safe)
• IP-based access control reference — auth-ip-based-profile-reference (safe)

Back to the fixture index