{
 "schema_version": 1,
 "generated": "2026-10-24",
 "id": "ch1nfo-riftx--test-access-control-across-identities",
 "repo": "Ch1nfo/RiftX",
 "repo_url": "https://github.com/Ch1nfo/RiftX",
 "repo_slug": "ch1nfo-riftx",
 "title": "Test access control with isolated browser identities",
 "page_title": "How to test access control with isolated browser identities with RiftX",
 "summary": "Compare anonymous, low-privilege, and high-privilege sessions side by side to find broken access control.",
 "who": "A tester on an authorized engagement who needs to check whether low-privilege users can reach high-privilege functions.",
 "problem": "Keeping separate logged-in states straight while replaying the same requests is error-prone, and state can leak between accounts.",
 "outcome": "A comparison of what each identity can access, backed by captured requests and responses for each identity.",
 "steps": [
  "Define the authorized test accounts in the target scope and note which role each one holds.",
  "Ask the Agent to log in each account using its own identity, since each identity has isolated cookies and storage.",
  "Have the Agent visit the same restricted endpoints under each identity and capture the requests and response bodies.",
  "Review the request_detail and response_body evidence side by side, and mark any access that should have been denied.",
  "Store cookie exports only in your own home directory and remove them when the engagement ends."
 ],
 "agent_prompt": "Using RiftX identities, compare access to the restricted endpoints of <target-url> for the anonymous, low-privilege, and high-privilege accounts I authorize. Produce a table of endpoint, identity, status, and captured evidence. Verify that each identity used its own isolated cookies and storage before you report a result.",
 "agents": [
  "any"
 ],
 "difficulty": "Advanced",
 "time": "60 minutes",
 "basis": "readme",
 "caveat": "RiftX keeps sessions and evidence in the current user's home directory, so you are responsible for protecting that data on shared machines.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "typescript",
 "requirements": [
  "Written authorization from the owner of the target system, with a defined scope",
  "A local machine where you can run the RiftX app (the README badges reference Node.js, Next.js, and React)",
  "A model provider key for OpenAI, Anthropic, Google, or a compatible endpoint",
  "Playwright and Chromium available for the browser tool"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "credentials",
   "notice": "Test account logins, cookies, and exported cookie files are sensitive; use only accounts you are authorized to test and delete exports after the engagement."
  }
 ],
 "best": false,
 "score": 0.8,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/ch1nfo-riftx/test-access-control-across-identities/",
 "md": "https://dedupedai.com/use-cases/ch1nfo-riftx/test-access-control-across-identities/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/ch1nfo-riftx--test-access-control-across-identities.json",
 "api_version": "v1"
}