Authentication Testing
Authentication testing verifies that a system correctly confirms a user or client's identity — accepting valid credentials, rejecting invalid ones, handling token expiry and refresh correctly, and properly locking out accounts after repeated failed attempts. It's the layer that answers "who is this," distinct from authorization, which answers "what are they allowed to do."
Beyond the obvious valid-login and invalid-login cases, thorough authentication testing covers the edges: expired tokens, malformed tokens, tokens signed with the wrong key, session fixation, concurrent sessions, and password reset flows — all common places where authentication bugs quietly turn into security vulnerabilities.
Modern authentication testing increasingly centers on JWTs and OAuth flows rather than simple username/password checks, since most APIs now authenticate via bearer tokens issued by an identity provider rather than checking credentials directly on every request.
