agent's session expired during a long pentest workflow: resume without re-auth

agent's session expired during a long pentest workflow: resume without re-auth

TL;DR

Long pentests outlive tool sessions by design, and a workflow that cannot resume turns every expiry into a full restart. Checkpoint scan state continuously (targets completed, findings so far), refresh the session with the refresh flow when it lapses, and resume from the checkpoint. Never restart the whole workflow.

agent's session expired during a long pentest workflow: resume without re-auth

Use this when

• A multi-hour pentest or vulnerability scan dies on session expiry
• The agent restarts the whole scan after every expiry
• Re-authenticating mid-run needs a human and stalls the workflow
• You are designing long assessment workflows and want the safe pattern

Not for this skill when

• Initial authentication to the scanner never works (that is setup, not expiry)
• You are designing the scan scope
• You are choosing the pentest tooling

Steps

1. Save state on an interval during the run: completed targets, the in-progress target, findings collected so far. Expected: a checkpoint artifact that updates as the scan progresses.

2. On session expiry, refresh the session (refresh-token flow) or re-authenticate once, instead of failing the run. Expected: a new valid session with the run still alive.

3. Reload the checkpoint and continue with the next uncompleted target. Expected: no target is scanned twice and none is skipped.

4. At the end, reconcile: verify the findings count matches the checkpoint totals. Expected: counts match, proving no gaps and no duplicates from the resume.

Variant: pentest scan session timeout resume

Same pattern. Keep the checkpoint outside the scanner's own session state so it survives the expiry that killed the session.

Variant: long vulnerability scan auth expired start over

The fix is exactly not starting over: the checkpoint from the dead run is the starting point of the resumed run.

Variant: scanner session expired mid assessment

If the scanner's API offers a refresh endpoint, call it proactively before the known expiry instead of waiting for the failure.

Why this happens

Sessions expire by design to bound the damage of a stolen token. Assessment workflows that treat the session as permanent turn a routine expiry into a lost night of scanning. Checkpoint plus refresh makes expiry a non-event.

Edge cases and pitfalls

• Refresh tokens expire too; plan for full re-auth as the fallback, not just refresh.
• Checkpoints must not store credentials or session tokens; store progress, not secrets.
• Parallel scan workers need shared checkpoint state, or two workers will scan the same targets after a resume.
• Verify the resumed scan covers the same scope; a scope change between runs invalidates the checkpoint.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstFG0IIZUr3b0WKP9Gx4niw