Authentication confirms who a user is. Authorisation controls what that user can do. Test both through the UI and direct requests.
On this checklist
Login
- Valid credentials work and invalid credentials fail.
- Empty, malformed, long and Unicode input is handled safely.
- Error messages do not reveal whether an account exists.
- Password characters are hidden and show/hide works correctly.
- Remember-me behaviour matches its stated lifetime.
- Return URLs cannot redirect to an unsafe external site.
Logout and sessions
- Logout invalidates the server session, not only the UI.
- Back navigation cannot reopen protected content.
- Old tokens and cookies fail after logout.
- Idle and absolute timeouts match requirements.
- Session ID changes after login and privilege change.
- Concurrent-device and multiple-tab behaviour is defined.
- Cookies use appropriate Secure, HttpOnly and SameSite settings.
Password reset
- Request response does not reveal whether the email exists.
- Token is random, single-use, time-limited and tied to the correct account.
- Old and modified links fail safely.
- A newer reset request handles older links as designed.
- New password rules and confirmation are enforced.
- Existing sessions are revoked when required.
Roles and permissions
Test server-side: hiding a button is not access control. Call the endpoint with a lower role and another user's resource ID.
| Test | Example |
|---|---|
| Horizontal access | User A requests User B's order. |
| Vertical access | Viewer calls an administrator endpoint. |
| Object ownership | Change an ID in URL, body or query. |
| Role change | Remove a role while the user has an active session. |
| Default access | New role receives only intended permissions. |
MFA
- Correct, incorrect, expired and reused codes.
- Clock drift and code attempt limits.
- Resend limits and invalidation of older codes.
- Backup codes are single-use and protected.
- Recovery and device-change flows verify identity.
- MFA cannot be skipped by direct navigation or API calls.
Abuse and edge cases
- Lockout or throttling slows attacks without enabling easy denial of service.
- Rate limits cover login, reset, resend and token endpoints.
- Case sensitivity and whitespace rules are consistent.
- Disabled, deleted and unverified accounts behave correctly.
- Passwords and tokens never appear in URLs, logs or analytics.
- CSRF protection covers state-changing browser requests.
- Errors contain no stack traces, secrets or identity hints.