Direct answer
Authentication testing examines how an application establishes a caller's identity and protects sensitive account transitions. Cover ordinary login, recovery, MFA enrollment, and identity changes using dedicated accounts and the owner's expected security policy.
List every way to establish identity
Password login is only one entry point. List social sign-in, magic links, recovery, device enrollment, API credentials, and administrative impersonation if the product supports them. Identify which controls belong to the application and which belong to an external identity provider.
- Record the supported flows rather than assuming all products use passwords.
- Use accounts and inboxes created for the assessment.
- Agree limits for unsuccessful sign-in and recovery requests.
Review failures and sensitive changes
Evaluate account enumeration, throttling, MFA behavior, and reauthentication for sensitive actions. Apply the relevant controls to the whole identity journey. Strong login protection loses value if an account can be reassigned through a weaker change-email or recovery path.
Reference: OWASP Authentication Cheat Sheet.
Use bounded negative cases
Compare a valid login with a small number of approved invalid attempts. Observe response behavior and rate controls without conducting a password attack. For MFA, test the intended enrollment, recovery, and removal sequence with the owner's fixtures.
- Do not use leaked credentials or real user accounts.
- Verify a failed attempt does not establish authenticated state.
- Keep delivery delays distinct from token validation failures.
Check account transitions end to end
After an email change, recovery, or identity unlink, verify which address receives security notifications and which identity can sign in. Repeat a harmless protected operation to establish the resulting account access. Capture the expected transition policy in regression tests.
Assessment limits
An application assessment does not authorize attacks on its identity provider or real users. Account lockout, provider restrictions, and message delivery can obscure results. Authentication success does not establish that authorization rules are correct.
Frequently asked questions
Is authentication testing just checking passwords?
No. Recovery, MFA, session creation, identity linking, and sensitive account changes can establish or alter access and need assessment when supported.
Can a scanner assess a third-party login provider?
The provider is a separate scope and control boundary. An application test can review its integration, but testing provider infrastructure needs separate authorization.
Does successful login prove account security?
It establishes that one expected identity flow worked. Permission enforcement, recovery, session invalidation, and other account transitions need separate checks.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.