Home / Help centre / Scan profiles
Scan profiles
What's the difference between the Auth and Authz classes?
Auth asks whether the app knows who you are: login, logout, MFA, OAuth, SSO, token lifetime and rate limiting. Authz asks what you may do once the app knows: ownership checks, tenant checks, IDOR and privilege escalation. Cyberlop keeps them as two separate classes.
The short version
Think of a building. Auth is the front desk that checks who you are. Authz is the lock on each room that decides where you may go. Both can fail on their own, so Cyberlop tests them with two different specialist agents.
How it works in Cyberlop
The in-app documentation describes each class in one line.
| Class | Question it answers | Examples |
|---|---|---|
| Auth | Does the app prove who you are? | Login and logout flows, MFA, OAuth and SSO, JWT lifetime, rate limiting |
| Authz | Does the app limit what you can do? | IDOR, missing ownership or tenant checks, privilege escalation |
Each agent stays in its own lane. The split is deliberate, because it keeps one weakness from showing up twice in your report. A missing ownership check is an Authz finding. A login that never locks out repeated guesses is an Auth finding.
Logins matter most for Authz. To check what one signed-in account can reach that it should not, give the profile a role for each kind of account you have, with the right privilege level. Cyberlop can then compare what each account can see. The page on two roles for access testing shows the setup.
What to do next
Tick Auth and Authz together in the Scope section for a thorough view of how your app handles identity and access. Add at least one login role in the Authentication section, because both classes work best behind a login. Tick no class to cover all ten.
The glossary pages on authentication, authorization and IDOR go deeper on the ideas. To set classes on a profile, see how to pick vulnerability classes.
Related questions
- Which vulnerability classes can Cyberlop test for?
- How do I set up two user roles so the scanner can test access between accounts?
- How do I add a login role to a scan profile?
- How do I choose which vulnerability classes a profile tests?
- How do I set a role's privilege level?
Choose vulnerability classes in a Cyberlop scan profile
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.