Authentication Testing Checklist: What AI Coding Tools Get Wrong About Auth

Yunhao Jiao1 min read

Authentication Testing Checklist: What AI Coding Tools Get Wrong About Auth cover

Authentication and authorization deserve explicit tests because a plausible login flow can still expose accounts or data. Test both permitted and denied behavior before release.

Use this as a starting checklist. Adapt thresholds and session rules to your product; record the request, expected status, and observed result for each test.

Login Flow

  • Valid credentials grant access and create session
  • Invalid password shows generic error (not "wrong password")
  • Repeated failures trigger the configured lockout or throttling rule; verify the threshold and recovery path
  • Repeated login requests exceed the configured limit and return the expected rate-limit response
  • "Remember me" creates persistent session correctly
  • Login redirects to originally requested page

Session Management

  • Session persists across page reloads
  • Session expires after configured timeout
  • Expired session redirects gracefully (no broken state)
  • After logout, reuse the old session token against a protected API; it must be rejected
  • Session tokens not exposed in URLs

Password Security

  • Passwords hashed with bcrypt/scrypt/argon2
  • Unique salt per user
  • A reset token works once, then fails on reuse and after its expiry period
  • Old password required for password change

Authorization

  • Direct access to each protected route and API without a session returns a denial
  • Using User A's session to request User B's record returns a denial and no private data
  • Role-based access enforced on frontend routes AND API endpoints
  • A non-admin session receives a denial from admin endpoints; an admin session succeeds

Automate the checks supported by your test environment, including API assertions and representative UI flows. Security controls such as rate limits and token handling may require dedicated fixtures or manual review; do not assume every item is covered by default.

Record failures with request details, expected behavior, and observed response. Retest after the fix.

Try TestSprite free →

More posts