agent browser automation failed on authorized app login form during scan setup

TL;DR

Login forms need the full browser treatment: wait for the form to be interactive, fill fields like a user (not instant JavaScript injection), submit, handle any second step, and verify the logged-in state before starting the scan. Most automation failures are timing or CSRF issues, not credential issues. Prove the login worked with a probe of an authenticated page before scanning.

agent browser automation failed on authorized app login form during scan setup

Use this when

• Automated login fails but the same credentials work manually.
• The scan setup step reports "not logged in" or lands back on the login page.
• The app is in your authorized engagement with engagement-provided credentials.

Not for this skill when

• The credentials are wrong. Verify manually first; automation cannot fix bad credentials.
• The app uses SSO or OAuth. That is a different flow with its own skill.
• The app is outside your authorized engagement. Do not automate its login.

Steps

1. Reproduce manually once and note the exact flow: number of steps, any CSRF token, any redirect after submit. Verify: you can describe the flow step by step.
2. In automation, wait for the username field to be visible and enabled before interacting; never assume the page is ready on load. Verify: the script logs the wait completing.
3. Fill the fields with realistic typing delays and submit via the form's submit button, not by setting values through script injection. Verify: any client-side validation runs as it would for a user.
4. Handle the post-submit state: wait for navigation, complete any second factor or confirmation step the engagement covers. Verify: the final URL is the app's authenticated landing page.
5. Probe an authenticated-only page and check for the logged-in marker before starting the scan. Verify: the probe succeeds; only then does scan setup complete.

Variant phrasings

playwright login form automation fails

Common phrasing.

agent cannot log into web app for scan

Symptom-level search.

automated login CSRF token handling

The usual root cause.

Compatibility: Playwright and similar browser automation. The wait-fill-verify pattern is framework-agnostic.

Why it happens

Agents write login scripts against the form's HTML without accounting for JavaScript-rendered fields, CSRF tokens fetched on load, or validation that only runs on real input events. The script "fills" fields the page has not finished building, submits nothing, and the scan starts anonymous.

Edge cases / pitfalls

• Rate limiting on the login endpoint can lock the test account after repeated automation failures. Debug with headed mode and few attempts.
• Some apps set session cookies with flags that headless browsers handle differently. If headless fails and headed works, compare the cookie jars.
• Never store the engagement credentials in the script. Read them from the engagement's credential store at runtime.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_e6545Bhv4jBWZawohJeHkw