Home / Help centre / Authentication & logins
Authentication & logins
What does "No auth roles. Add a role to scan behind login, or leave empty for unauthenticated scanning." mean?
"No auth roles" is an empty-state note, not an error. It means the profile has no login roles, so the scan runs unauthenticated. Click + Add role on the Authentication section if your app needs a login, or leave it empty to scan public pages only.
Why this happens
The message appears when a profile has no roles. The full text reads: No auth roles. Add a role to scan behind login, or leave empty for unauthenticated scanning. Nothing is broken. A new profile starts this way.
With no roles, the scanner sees only what an anonymous visitor sees. Pages behind a login stay out of reach.
How to fix it
You only need to act if your app has pages behind a login.
- Open the profile and go to Authentication.
- Click + Add role.
- Enter a Name and a Privilege level: Unauthenticated, User, Elevated or Admin.
- Tick one or more Authentication methods. You can combine them, for example form plus header.
- Fill in the method fields, then click Save.
If your app is fully public, leave the list empty. That is a valid setup.
A profile can hold more than one role. Many setups add a normal User role and an Admin role, so the scan can compare what each signed-in account can reach. Each role has its own name, privilege level and method. You can remove a role later with the trash icon on its card. An empty list is a fair choice for a public marketing site or a documentation portal, where nothing sits behind a sign-in and anonymous testing covers the whole app. Add roles only when a login exists to test, and keep each role for one kind of account.
Still not working?
Check that you saved the profile after adding the role. The roles count in the Scan Profiles list should now show a number above zero. If the scan still finds nothing behind login, read why a scan finds nothing behind the login. For help with a stubborn login, use /contact.
Related questions
- How do I run a scan without any login?
- My scan found nothing behind the login. Why?
- What is an authentication role?
- How do I set a role's privilege level?
- The scanner isn't getting past my login page. What should I check?
How to scan behind login in Cyberlop with authentication roles
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.