Use case indexS6 · Password remediation verification · browser + command line verification

S6 — Leaked-password forced change

HIBP alone never creates pending. Remediation starts only when the password is both HIBP-breached and the origin confirms it is the account’s valid credential. No authenticated session is issued on that path.
Direct originRewrite Worker
Hosts s6-origin…/ s6…/login
Breached + valid Session issued; app access No session; redirect to /__rs/pwned + scoped CSRF cookie
Browser verification

Run a read-only check in this browser. The result explains the response evidence; use the command-line section below for deeper inspection.

Not run yet.

1. Seed accounts (PoC only)

EmailPasswordExpected on capability
alice@thecompany-lab.com password Breached + valid → remediation (no session)
bob@thecompany-lab.com Str0ng-Unique-Passphrase!2026 Clean + valid → normal login success

2. Browser verification

Open capability login Open origin login Remediation page
  1. Origin: log in as Alice → session cookie + access (unprotected).
  2. Capability: log in as Alice → 302 to /__rs/pwned, cookie s6_rs_csrf (Path=/__rs; HttpOnly; Secure; SameSite=Strict), no s6_session.
  3. On /__rs/pwned: OTP form + Turnstile; complete flow with a strong new password.
  4. Log in as Bob on capability → normal success (no remediation).

3. Command-line verification (copy and run)

# Breached + valid (API) — expect 403 JSON, no Set-Cookie session
curl -s -D - -X POST https://s6.thecompany-lab.com/login   -H 'Content-Type: application/json' -H 'Accept: application/json'   -d '{"email":"alice@thecompany-lab.com","password":"password"}'

# Clean + valid (API) — expect success path from origin (session possible)
curl -s -D - -X POST https://s6.thecompany-lab.com/login   -H 'Content-Type: application/json' -H 'Accept: application/json'   -d '{"email":"bob@thecompany-lab.com","password":"Str0ng-Unique-Passphrase!2026"}'

# Browser-like Alice login — capture CSRF cookie on redirect
curl -s -D - -o /dev/null -c /tmp/s6.txt -X POST https://s6.thecompany-lab.com/login   -H 'Content-Type: application/x-www-form-urlencoded'   --data 'email=alice@thecompany-lab.com&password=password'
cat /tmp/s6.txt
curl -s -b /tmp/s6.txt https://s6.thecompany-lab.com/__rs/pwned | grep -E 'csrf|turnstile|otp' | head

Pass criteria