Monitoring for authentication information

An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:

• receive, by a program, a request from an entity to access a resource;
• in response to the request being an authentication request:
• perform, by the program, a verification of a credential included in the request, the program to grant access to the resource and add authentication information into a Hypertext Transfer Protocol (HTTP) session storage in response to verifying the credential, and the program to not add the authentication information into the HTTP session storage in response to not verifying the credential;
• monitor, by a monitoring agent, information added to the HTTP session storage by the program as part of processing the authentication request;
• determine, by the monitoring agent based on the monitoring, whether the authentication information is stored in the HTTP session storage;
• indicate, by the monitoring agent, a successful authentication attempt in response to determining that the authentication information is stored in the HTTP session storage;
• and
• indicate, by the monitoring agent, an unsuccessful authentication attempt in response to determining that the authentication information is not stored in the HTTP session storage.

A system comprising:

• a processor;
• and
• a non-transitory storage medium storing a program executable on the processor to:
• receive a request from a client computer to access a web application, and
• in response to the request being an authentication request, perform a verification of a credential included in the request, the program to grant access to the web application and add authentication information into a Hypertext Transfer Protocol (HTTP) session storage in response to verifying the credential, and the program to not add the authentication information into the HTTP session storage in response to not verifying the credential;
• wherein the non-transitory storage medium further stores a monitoring agent executable on the processor to:
• determine whether the request is the authentication request by determining whether a uniform resource locator of the request contains a string from among a collection of specified strings,
• in response to determining that the request is the authentication request, monitor information added to the HTTP session storage by the program as part of processing the authentication request in an HTTP session between the client computer and the web application,
• determine, based on the monitoring, whether the authentication information is stored in the HTTP session storage,
• determine, based on whether the authentication information is stored in the HTTP session storage, whether the authentication request is a successful authentication attempt or an unsuccessful authentication attempt, and
• determine, based on events relating to successful authentication attempts and unsuccessful authentication attempts, whether a security issue is present in the system.