Login page testing checklist
Twenty-five checks against a service you own or have written permission to test, on an environment where a mistake costs nothing. The order matters more here than in most reviews. A finding about session timeout means one thing if the session is a signed token and another if it is a database row, so what the session is gets established before anything is measured about it. The last four groups exist because most services have more than one way to hand out a session, and a password reset, an email link or an identity provider can each mint one that the login page's own rules never touched. None of these are attack procedures. They are the defensive readings of the same facts.
25 checksabout 209 min end to end
That the login works, and how it decides
- How to test login functionality
Establish the working path and the failure path before measuring anything about either. - How to test login with curl
A client that prints its own request separates a server problem from a browser problem, and the cookie engine has to be switched on before it keeps anything. - How to check authorization header
Read what the service actually accepts as proof of identity, since the header and the cookie are often both live and only one is documented. - How to test basic auth with curl
Credentials in a header are re-sent on every request, so the failure mode is different from a session and worth confirming rather than assuming. - How to test digest auth with curl
The challenge and response exchange takes two requests, so a test that reads one of them draws the wrong conclusion.
What the session actually is
- How to check session id
Everything below depends on whether the identifier carries state or points at it, and the two fail in opposite ways. - How to check cookie expiry
A session cookie and a persistent cookie with a long lifetime look alike in a browser and behave differently after the tab closes. - How to check session fixation
An identifier that survives the login is the defect, and the reading is one comparison before and after. - How to check session timeout
An idle limit and an absolute limit are different rules, and a service often publishes one while enforcing the other.
Ending a session
- How to test logout invalidates token
Clearing the client is not ending the session, and only a request with the old credential answers which one happened. - How to check if session expires after logout
The server side of the same question, read from the session the client has already thrown away. - How to test concurrent sessions
Two jars answer whether a session is per device or per account, which decides what every logout above is supposed to do. - How to test remember me functionality
The remembered credential usually outlives the session and often survives the logout that was meant to end it.
Tokens, where they are used
- How to check if refresh token works
A refresh that works and a refresh that silently reissues the same expiry are both a 200, so the new token has to be read. - How to test expired token
An expired token accepted once is accepted always, and the only way to see it is to wait past the expiry rather than to read the claim.
Guessing, and the second factor
- How to test account lockout after failed logins
A lock tested on the wrong-password branch alone lets the correct password straight through one second after the account locked. - How to test two factor authentication
The first-factor cookie frequently reaches the account page on its own, which makes the second factor decorative. - How to test totp
The acceptance window is a measurable band rather than a setting, and a generator checked against the RFC vectors is what makes the rest of the reading trustworthy.
The other ways a session is handed out
- How to test password reset flow
A reset token that survives its own use is a second password, and the sessions open before the reset usually survive it. - How to test change password flow
The old password stops working while the old session keeps working, and that asymmetry needs two cookie jars to see. - How to test email verification link
Verification often flips one status and gates nothing, so an unconfirmed account signs in and reads the account page.
Delegated identity
- How to test oauth login flow
The redirect chain carries the values that matter, and they are visible only while the flow is in progress. - How to test authorization code flow with curl
The code exchange is the step where a misconfigured client secret or redirect URI produces a usable token anyway. - How to test oidc
The discovery document states what the provider claims to support, which is the reference every reading above is compared against.
Requests the user did not make
- How to test CSRF protection
Every session confirmed above is a session another site can spend, and the token is only protection if the server rejects a request without it.
Take it with you
The file is the same list as Markdown checkboxes, ready to paste into a release ticket or a pull request description.
Ticks are kept in this browser only. They are not sent anywhere and other people do not see them.