ROT HACKERSACADEMYStart learning
Courses/WSHawk Practitioner/Lesson 02
01.02 / 35 min

Record User A, User B, and Admin

Capture three independent authenticated browser states and store each one as a named project identity.

By the endUse the auth-flow recorderAvoid identity overwriteVerify each session with /auth/me
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Create a dedicated project

Open the Electron + Go edition, accept the authorized-testing notice, create a project named Academy Lab, and set its target origin to the exact local URL above.

Expected result

The project header shows Academy Lab and the target is 127.0.0.1:5177.

02

Record User A

Open Advanced → Blaster → Record Auth Flow. Enter the full /login URL. Sign in with user_a / user-a-lab-pass. Return to WS Forge, choose Store DOM Identity, and save it as User A.

http://127.0.0.1:5177/login
Expected result

The identity list contains User A and reports a captured session cookie.

03

Repeat in fresh recorder sessions

Use Re-record Auth for user_b / user-b-lab-pass and admin / admin-lab-pass. Store each result immediately as User B and Admin. Do not rename a single reused session three times.

Expected result

Three separately stored identities appear: User A, User B, and Admin.

04

Verify every identity

In HTTP Forge, set GET /auth/me and choose Replay as Identity for each saved identity. Compare username, role, and tenant in the responses.

GET http://127.0.0.1:5177/auth/me
Expected result

The three responses identify user_a, user_b, and admin respectively.

MASTERY CHECKPOINT

Prove it before moving on.

Replaying /auth/me as each saved identity returns three distinct usernames. If not, delete and record the duplicated identity again.