DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to test access control with isolated browser identities with RiftX

Compare anonymous, low-privilege, and high-privilege sessions side by side to find broken access control.

Authorization notice. RiftX is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Credentials. Test account logins, cookies, and exported cookie files are sensitive; use only accounts you are authorized to test and delete exports after the engagement.

Who it is forA tester on an authorized engagement who needs to check whether low-privilege users can reach high-privilege functions.

The problemKeeping separate logged-in states straight while replaying the same requests is error-prone, and state can leak between accounts.

The outcomeA comparison of what each identity can access, backed by captured requests and responses for each identity.

What you need first

  • Written authorization from the owner of the target system, with a defined scope
  • A local machine where you can run the RiftX app (the README badges reference Node.js, Next.js, and React)
  • A model provider key for OpenAI, Anthropic, Google, or a compatible endpoint
  • Playwright and Chromium available for the browser tool

Steps

  1. Define the authorized test accounts in the target scope and note which role each one holds.
  2. Ask the Agent to log in each account using its own identity, since each identity has isolated cookies and storage.
  3. Have the Agent visit the same restricted endpoints under each identity and capture the requests and response bodies.
  4. Review the request_detail and response_body evidence side by side, and mark any access that should have been denied.
  5. Store cookie exports only in your own home directory and remove them when the engagement ends.

Prompt for your agent

Using RiftX identities, compare access to the restricted endpoints of <target-url> for the anonymous, low-privilege, and high-privilege accounts I authorize. Produce a table of endpoint, identity, status, and captured evidence. Verify that each identity used its own isolated cookies and storage before you report a result.

Caveat. RiftX keeps sessions and evidence in the current user's home directory, so you are responsible for protecting that data on shared machines.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for Ch1nfo/RiftX and "Test access control with isolated browser identities"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer