The commonest serious weaknesses.
WHAT TO TEST ABOUT AUTHENTICATION
Weak credentials rejected Rate limiting on attempts Account lockout behaviour Session established correctly Sessions invalidated on sign-out Password reset flows
WHY PASSWORD RESET SPECIFICALLY
It is a route to account takeover, and frequently weaker than the login itself.
WHAT TO VERIFY ABOUT RESET
Tokens expire Tokens are single use Tokens are unguessable The flow does not reveal whether an account exists
WHAT TO TEST ABOUT SESSIONS
Expiry Behaviour after credential change Whether a session can be fixed by an attacker Whether tokens are protected appropriately
WHAT TO TEST ABOUT AUTHORISATION
Access to another user's resources by changing an identifier Access to administrative functions as a normal user Actions permitted through an interface that should not be Authorisation checked on every request, not only at navigation
WHY THAT LAST POINT
Hiding a control in the interface is not authorisation.
HOW TO TEST IT
Call the endpoint directly.
WHAT TO TEST ABOUT ROLES
Every role, against every protected function.
WHAT TO AUTOMATE
That matrix, since it is large and must be rechecked.
