probely_configure_logout_detection
Automates logout detection setup for web scans, enabling the scanner to identify when re-authentication is needed by configuring session check URLs and logout detectors, with auto-detection from the login sequence.
Instructions
Configure logout detection for a target. This helps the scanner detect when it needs to re-authenticate.
The Probely API requires BOTH check_session_url AND at least one logout detector to be defined before logout detection can be enabled. This function handles the proper ordering automatically.
When no detector is specified, the tool automatically extracts a CSS selector from the target's login sequence (typically the username field) and uses it as the logout detector. This is the most reliable approach: if the login form elements appear on the page, the user is logged out.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | The target ID | |
| enabled | No | Whether to enable logout detection (default: True) | |
| check_session_url | No | URL to check if session is still valid. Should return 200 when logged in, and 401/403 when logged out. Common examples: /api/me, /api/user, /api/session | |
| logout_detector_type | No | Type of logout detector to create if none exist. Options: 'sel' (CSS selector - recommended), 'text' (text after logout), 'url' (redirect URL). If not provided, auto-extracts CSS selector from login sequence, or falls back to 'text: Login'. | |
| logout_detector_value | No | Value for the logout detector. Required if logout_detector_type is provided. | |
| logout_condition | No | When to consider the target logged out based on detectors. 'any' (default) = logged out if ANY detector matches (OR logic). 'all' = logged out only if ALL detectors match (AND logic). Use 'all' when some detector patterns also appear on the logged-in page. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||