Actions
SQA #4110
openSQA #4080: [SQA] Authentication Module Testing
[SQA] Reviewing the Auth module and listed some queries
Added by Aman Bhuiyan 3 months ago. Updated 2 months ago.
Updated by Aman Bhuiyan 3 months ago
- Subject changed from [SQA] Authentication Module Testing to [SQA] Reviewing the Auth module and listed some queries
- Assignee set to Aman Bhuiyan
- % Done changed from 0 to 60
Authentication & Session Management¶
- Reviewed “Keep me logged in” functionality and raised concerns regarding undefined cookie/session duration.
- Suggested clearly defining session persistence duration (e.g., 7–30 days) with secure cookie handling.
- Analyzed passwordless authentication (magic link / OTP) feasibility for Sign In & Sign Up flows.
- Provided recommendation with example for implementing passwordless login to improve security and UX.
- Reviewed multi-device & multi-browser sign-in behavior and suggested defining concurrent session limits and logout behavior (device-only vs global).
Security & Abuse Prevention¶
- Identified account enumeration risk in Reset Password flow where “User not Found” is displayed.
- Suggested using generic reset responses to prevent attackers from identifying registered emails.
- Reviewed concerns around allowing temporary/disposable email addresses during registration.
- Highlighted phishing and impersonation risks related to visually similar usernames (e.g., trailing dots).
- Recommended normalization and validation rules for agency names.
- Suggested restricting numeric-only agency names to reduce fake or automated account creation.
- Reviewed UUID usage and confirmed UUID v4 is not realistically guessable but should not be used as a secret.
Validation & Input Rules¶
- Raised query regarding email address maximum length during registration.
- Suggested enforcing RFC-aligned limits (e.g., max 254 characters) on both frontend and backend.
- Reviewed valid vs invalid email formats for test coverage.
UI / UX & Layout¶
- Highlighted UI terminology inconsistency between “Log in” and “Sign In” on the same page.
- Suggested standardizing wording for clarity and consistency.
- Raised questions about responsive layout breakpoints due to lack of Figma/design specs.
- Suggested defining explicit breakpoint ranges and corresponding layouts (mobile/tablet/desktop).
- Discussed layout testing depth given functional-first development focus; proposed baseline UI testing scope.
- Identified incorrect redirection for “Let’s Complete Your Profile” button and suggested aligning it with onboarding flow.
- Noted Reset Password page visibility issue in Lovable environment impacting UI validation.
Overall:
Focused on improving security posture, reducing impersonation and enumeration risks, clarifying session and authentication behavior, and defining clear UI/layout expectations to support future enhancements (payments, agency verification) and stable user experience.
File¶
Updated by Aman Bhuiyan 2 months ago
- % Done changed from 60 to 80
Activities Summary¶
- Reviewed FRD workflows related to agency sign-up and welcome page URLs
- Clarified public vs internal usage of customized agency URLs
- Discussed agency name uniqueness and URL collision scenarios (e.g., Softeko vs Softeko.)
- Drafted and refined product clarification questions for FRD review
- Standardized wording and improved multiple stakeholder-facing responses
- Identified URL naming inconsistencies (signin/signup vs sign-in/sign-up) and proposed standardization
File¶
Actions