# Authentication Session Testing

Black-box testing of the full authentication and session lifecycle - registration...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill authentication-session-testing -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill authentication-session-testing -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill authentication-session-testing -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill authentication-session-testing -g -a gemini-cli -y`

## Description

Black-box testing of the full authentication and session lifecycle - registration, login, MFA, password reset, recovery, email change, logout, refresh, device trust - and session token handling including fixation, invalidation, replay, and cross-context binding.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Authentication and Session Testing

## Purpose

Test the entire account and session lifecycle as a state machine, not just login. Every lifecycle transition (register, verify, login, MFA, reset, recovery, email change, role change, logout) is a boundary where revocation, binding, or downgrade logic is forgotten.

## Entry Conditions

- The target has any account lifecycle: signup, login, password reset, MFA, profile/email change, or log-out-other-sessions features
- You hold at least one valid account (ideally two, plus control of a second email address)

## Step 0: Find the REAL Session Token

Apps set many cookies (analytics, CSRF, consent). Delete cookies one at a time and re-request a protected page - the one whose removal logs you out is the session token. Test only that one for the flaws below.

## Session Lifecycle Matrix

Capture a valid session token, then perform each lifecycle event in a SEPARATE session and replay the old token against a protected route. Record status + body differential for each:

| Event | Question | Evidence to capture |
|---|---|---|
| Logout | is the old token dead server-side? | old cookie replay after logout |
| Password change | are other sessions revoked? | old session still valid after change |
| Password reset | does reset invalidate all sessions? | old session after reset completes |
| MFA change / enrollment | are sessions re-verified? | old session after MFA enrollment |
| Role change (up or down) | does privilege apply to existing sessions? | old session reaching admin route after downgrade |
| Account disable / deletion | immediate revocation? | old session after admin-side disable |
| Email change | does notification + re-verification occur? | old session after email change |

A stale token still working after logout is a server-side revocation failure (critical for stolen-session scenarios) - prove it with a state-changing request, not a cached GET.

## Session Token Handling

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/application-security/authentication-session-testing/SKILL.md