audit agent stuck behind login wall after session expired

audit agent stuck behind login wall after session expired - how to fix it

TL;DR

Detect the login wall and recover: when the agent sees a login form mid-audit where authenticated content should be, it should re-authenticate once, verify, and resume, or report blocked coverage if re-auth fails. One line of why: session expiry mid-run silently converts every remaining page into the login page, and auditing the login page 300 times is not an audit.

The error, verbatim

AuditAgentError: login wall detected mid-audit, session expired
    expected: /admin/users, got: /login
    pages_affected: 290 (all audited as login page)

Fix it step by step

Step 1: Reproduce the wall

node agent/crawl.js --auth | rg -i 'login|wall|401' | head -5

Expected: The agent starts hitting the login page mid-crawl.

Step 2: Confirm it is session expiry

node -e "console.log('session ttl 30m elapsed at page 210, all later pages are /login')"

Expected: The timing matches the session lifetime.

Step 3: Add wall detection and recovery

rg -n 'login|auth' agent/crawl.js | head -10

Expected: Add: detect unexpected login page, re-authenticate once, resume; report blocked pages if it fails.

Step 4: Re-run the audit

node agent/crawl.js --auth | tail -4

Expected: Agent re-authenticates at the wall and completes the crawl.

Step 5: Add a regression probe

node agent/run-audit.js --smoke | tail -3

Expected: Smoke run passes; schedule it so the breakdown is caught if it ever regresses.

When to use this skill

• You run an agent that scans UIs for accessibility and it hits this breakdown
• The agent's scan loop stalls, crashes, or loops on this exact failure
• You are hardening an audit agent's error handling for production scans

When NOT to use this skill

• A human runs the scan manually and it works, this is agent-harness failure handling
• The scan completes and only reports violations, use the rule-specific skills

Compatibility

Audit agent with auth support. Wall detection compares the current URL and page markers against expectations. Pin the tool version in the lockfile so scans stay reproducible across machines.

Variant phrasings

agent hit login wall mid audit

Same wall, same recovery.

session expired audit login page loop

Practitioner phrasing.

the breakdown hits other routes too

Agent failure modes are systemic; apply the hardening to every route the agent covers, not just the one that failed.

Why it happens

Sessions expire mid-run, and the app redirects to login. An agent without wall detection keeps crawling, and every subsequent page audits as the login page, producing hundreds of duplicate login-page results and zero real coverage. Wall detection is cheap: if the URL is the login route or a login form appears where content was expected, stop and recover. Recovery is re-authenticate once and resume from the frontier; if re-auth fails, report the remaining pages as blocked, not as clean. Agent breakdowns are systemic: the same failure mode will hit every route, page, or run the agent touches. Harden the harness once (timeouts, loop detection, verification gates) instead of patching per page, and keep breakdown telemetry separate from violation counts.

Edge cases

• Dedupe identical login-page audits in reporting, they are one finding (session handling), not 290 findings.
• Combine with proactive session refresh so the wall rarely triggers.
• Some apps show a modal login instead of redirecting, detect both shapes.
• Log breakdowns separately from violations in agent telemetry; mixing them hides whether the agent itself is getting more reliable.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_NjfgamC-b8EjmV7sJ7HJ9A