use-profiles

Using Playwright Authentication Profiles

Purpose

Load saved Playwright storageState authentication profiles before browser automation work. This eliminates the need to log in manually at the start of every browser session.

When This Applies

This skill applies when ALL of the following are true:

1. The current project has a .playwright/profiles.json file
2. Browser automation work is about to begin (using Playwright MCP tools)
3. The target page requires authentication

Profile Discovery

Check for .playwright/profiles.json at the project root. Read it to discover available profiles. The file contains entries like:

{
  "profiles": {
    "admin": {
      "loginUrl": "https://example.com/login",
      "description": "Full permissions"
    }
  }
}

Each profile has a corresponding storageState file at .playwright/profiles/<role-name>.json.

Profile Selection

Determine which profile to use based on conversation context:

• If the user mentions a specific role (e.g., "test the admin dashboard", "check the speaker view"), match it to a profile name from the config.
• If the user does not specify a role and only one profile exists, use it automatically.
• If the user does not specify a role and multiple profiles exist, ask which one to use. Present the available profiles with their descriptions.

Loading a Profile

Before navigating to any authenticated page, load and validate the profile:

1. Verify the storageState file exists at .playwright/profiles/<role-name>.json. If it does not exist, inform the user and suggest running /setup-profiles to create it.

2. Read the storageState JSON file. It contains cookies and origins (localStorage) arrays.

3. Pre-load health check (RT-08): Before injecting cookies, inspect the cookie health:

   • For any cookie whose value starts with base64- (Supabase auth): decode the base64 payload (Buffer.from(value.slice(7), 'base64').toString()), parse the JSON, and check expires_at. If expires_at < Date.now()/1000, the session is expired.
   • For any cookie whose value looks like a JWT (three dot-separated base64url segments): decode the middle segment, parse the JSON, and check exp. If exp < Date.now()/1000, the JWT is expired.
   • For standard cookies: check the expires field. If expires > 0 and expires < Date.now()/1000, the cookie is expired.
   • Count session-only cookies (expires <= 0). If >30% of cookies are session-only, note this.