# HAR Recording Summary

Extracted from a browser HAR recording of a login session against `cookidoo.ch` on 2026-05-08.
Sensitive values (passwords, tokens, session IDs) are redacted.

The full HAR file contained 123 entries. Only the login-relevant entries are documented here.
Static assets (CSS, JS, fonts, images) are omitted.

## Entry 0: Initiate Login

```http
GET https://cookidoo.ch/profile/de-CH/login?redirectAfterLogin=%2Ffoundation%2Fde-CH%2Ffor-you
→ 302
Location: https://cookidoo.ch/oauth2/start?market=ch&ui_locales=de-CH&rd=%2Fprofile%2Fde-CH%2Flogin%3FredirectAfterLogin%3D%252Ffoundation%252Fde-CH%252Ffor-you
```

## Entry 1: OAuth2 Proxy Start

```http
GET https://cookidoo.ch/oauth2/start?market=ch&ui_locales=de-CH&rd=...
→ 302
Location: https://ciam.prod.cookidoo.vorwerk-digital.com/authz-srv/authz?client_id=tmde2-live-v1&code_challenge=<REDACTED>&code_challenge_method=S256&market=ch&redirect_uri=https%3A%2F%2Fcookidoo.ch%2Foauth2%2Fcallback&response_type=code&scope=openid+profile+email+offline_access&state=<REDACTED>&ui_locales=de-CH
Set-Cookie: _oauth2_proxy_csrf=<REDACTED>; domain=cookidoo.ch; path=/; HttpOnly; secure
```

## Entry 2: CIAM Authorization

```http
GET https://ciam.prod.cookidoo.vorwerk-digital.com/authz-srv/authz?client_id=tmde2-live-v1&...
→ 302
Location: https://eu.login.vorwerk.com/ciam/login?requestId=4814594a-fe30-4c74-aad9-eaf750b3b4a3&view_type=login&market=ch&ui_locales=de-CH
Set-Cookie: cidaas_dr=<REDACTED>; domain=ciam.prod.cookidoo.vorwerk-digital.com; path=/; HttpOnly
Set-Cookie: cidaas_sid=; (cleared)
Set-Cookie: cidaas_sso=; (cleared)
Set-Cookie: cidaas_rl=; (cleared)
```

## Entry 3: Login Page (200 OK)

```http
GET https://eu.login.vorwerk.com/ciam/login?requestId=4814594a-fe30-4c74-aad9-eaf750b3b4a3&view_type=login&market=ch&ui_locales=de-CH
→ 200
Content-Type: text/html

Response body contains HTML with login form including:
  <input type="hidden" name="requestId" value="4814594a-fe30-4c74-aad9-eaf750b3b4a3">
  <form action="https://ciam.prod.cookidoo.vorwerk-digital.com/login-srv/login" method="POST">
```

## Entry 16: POST Credentials

```http
POST https://ciam.prod.cookidoo.vorwerk-digital.com/login-srv/login
Content-Type: application/x-www-form-urlencoded

requestId=4814594a-fe30-4c74-aad9-eaf750b3b4a3&username=<REDACTED>&password=<REDACTED>

→ 302
Location: https://cookidoo.ch/oauth2/callback?code=<AUTH_CODE>&state=<STATE>
Set-Cookie: cidaas_sid=<REDACTED>; Domain=ciam.prod.cookidoo.vorwerk-digital.com; Expires=~1year
Set-Cookie: cidaas_rl=<REDACTED>; Domain=ciam.prod.cookidoo.vorwerk-digital.com; Expires=~14days
Set-Cookie: cidaas_sso=<REDACTED>; Domain=ciam.prod.cookidoo.vorwerk-digital.com; Expires=~14days
```

## Entry 18: OAuth2 Callback

```http
GET https://cookidoo.ch/oauth2/callback?code=<AUTH_CODE>&state=<STATE>
→ 302
Location: /profile/de-CH/login?redirectAfterLogin=%2Ffoundation%2Fde-CH%2Ffor-you
Set-Cookie: _oauth2_proxy_csrf=; max-age=0; domain=cookidoo.ch (cleared)
Set-Cookie: _oauth2_proxy=<REDACTED>; domain=cookidoo.ch; HttpOnly; secure
Set-Cookie: v-authenticated=<REDACTED>; max-age=2591940; domain=cookidoo.ch; secure
Set-Cookie: v-is-authenticated=true; max-age=2591940; domain=cookidoo.ch; secure
```

## Entry 19: Final Redirect

```http
GET https://cookidoo.ch/profile/de-CH/login?redirectAfterLogin=%2Ffoundation%2Fde-CH%2Ffor-you
→ 307
Location: /foundation/de-CH/for-you
Set-Cookie: XSRF-TOKEN=<REDACTED>; Path=/profile; Secure
```

## Key Observations

1. The `requestId` is generated by the CIAM server and embedded in the login page HTML.
2. PKCE (S256 code challenge) is used — the OAuth2 proxy generates and verifies it.
3. The `_oauth2_proxy_csrf` cookie is set during start and cleared after callback.
4. The three essential auth cookies after login are: `_oauth2_proxy`, `v-authenticated`, `v-is-authenticated`.
5. `v-authenticated` and `v-is-authenticated` have `max-age=2591940` (~30 days).
6. Entries 4–15 and 17 are static asset loads (CSS, JS, fonts) — not relevant to the auth flow.
