Authentication Smoke Test — live demo

Five of the eighteen checks, running against a simulated API. Nothing is installed and nothing leaves your browser.

Defects: Run a check in both states. Watching the same check pass and fail is the point.

4Error messages reveal whether an account exists

Do this. Sign in with an address that does not exist, then a real one with a wrong password. Compare the wording, the status, and the time.

Two different messages turn a login form into a membership oracle: submit ten thousand addresses, learn which belong to your customers.

3The response contains no credentials

Do this. Sign in successfully and read every field of the response, not just the one you wanted.

You only find a PIN in a response by reading fields you did not ask for.

9A password change kills every other session · CRITICAL

Do this. Sign in twice, so two sessions exist. Change the password using the first. Then use the second token.

This is the control that evicts an attacker. A user who suspects compromise changes their password — the one thing everybody knows to do. If it does not kill the other session, that action is ceremonial and they stop looking.

16Logout invalidates the session server-side · CRITICAL

Do this. Capture the raw token. Log out. Send the same token again — not through the interface, directly.

Testing logout through the interface proves nothing; the interface threw its copy away. The question is whether the server did.

17One user cannot read another user's record

Do this. Fetch your own record, note the identifier, change it to someone else's, send it again.

Broken object-level authorization is the most commonly reported serious defect in web APIs. It survives because the interface never offers you the option.

The other thirteen

Password policy enforced server-side · unverified accounts blocked · lockout and counter reset · exact password comparison · reset token expiry · single-use reset tokens · reset token delivery · MFA rate limiting · MFA code reuse · MFA bypass · session expiry · session rotation on login · admin endpoint access.

All eighteen, with steps and expected results, are in the free checklist.

Get the free checklist

Network — what the API actually returned

Run a check. Every request and response appears here, the way it would in your browser's developer tools.

This page runs entirely in your browser. There is no server, no account, no data stored and nothing transmitted. The "API" is simulated in JavaScript so the defects are safe to demonstrate — a genuinely vulnerable application should never be put on the public internet, which is a lesson in itself.