Authentication and Session Testing

Purpose

Test the entire account and session lifecycle as a state machine, not just login. Every lifecycle transition (register, verify, login, MFA, reset, recovery, email change, role change, logout) is a boundary where revocation, binding, or downgrade logic is forgotten.

Entry Conditions

• The target has any account lifecycle: signup, login, password reset, MFA, profile/email change, or log-out-other-sessions features
• You hold at least one valid account (ideally two, plus control of a second email address)

Step 0: Find the REAL Session Token

Apps set many cookies (analytics, CSRF, consent). Delete cookies one at a time and re-request a protected page - the one whose removal logs you out is the session token. Test only that one for the flaws below.

Session Lifecycle Matrix

Capture a valid session token, then perform each lifecycle event in a SEPARATE session and replay the old token against a protected route. Record status + body differential for each:

Event	Question	Evidence to capture
Logout	is the old token dead server-side?	old cookie replay after logout
Password change	are other sessions revoked?	old session still valid after change
Password reset	does reset invalidate all sessions?	old session after reset completes
MFA change / enrollment	are sessions re-verified?	old session after MFA enrollment
Role change (up or down)	does privilege apply to existing sessions?	old session reaching admin route after downgrade
Account disable / deletion	immediate revocation?	old session after admin-side disable
Email change	does notification + re-verification occur?	old session after email change

A stale token still working after logout is a server-side revocation failure (critical for stolen-session scenarios) - prove it with a state-changing request, not a cached GET.

Session Token Handling