---
title: "Authentication QA recipes"
description: "Verify sign-in, session handling and account boundaries through observable application behavior and test-owned identities."
canonical_url: "https://vostride.com/agent-library/authentication.md"
md_url: "https://vostride.com/agent-library/authentication.md"
content_kind: "index"
topic: "authentication"
---

# Authentication QA recipes

Verify sign-in, session handling and account boundaries through observable application behavior and test-owned identities.

Use fresh and authenticated states deliberately. A dashboard screenshot is insufficient unless the account and organization match the intended identity.

## Pages (10)

- [Verify signing into another account clears private cached content](https://vostride.com/agent-library/authentication/account-switch-cache-isolation.md): Sign out of one test account and into another in the same browser, then check navigation, cached records, and account labels for identity leakage.
- [Verify session expiry preserves an honest unsaved-form state](https://vostride.com/agent-library/authentication/expired-session-unsaved-form.md): Test an expired session during form editing and confirm the app requires sign-in, avoids a phantom save, and handles the draft according to policy.
- [Verify a temporary login outage supports a clean retry](https://vostride.com/agent-library/authentication/login-error-recovery.md): Simulate an application-owned authentication outage and verify that one retry signs in correctly without losing the destination or duplicating sessions.
- [Verify logout blocks protected history and fresh requests](https://vostride.com/agent-library/authentication/logout-protected-history.md): Exercise sign-out followed by browser history, reload, and direct private navigation to separate cached page appearance from active session access.
- [Verify a magic sign-in link cannot be reused](https://vostride.com/agent-library/authentication/magic-link-single-use.md): Check a passwordless email link from a test inbox, then attempt reuse after logout to verify consumption and correct account binding.
- [Verify an MFA challenge rejects a wrong code before accepting a valid one](https://vostride.com/agent-library/authentication/mfa-invalid-then-valid-code.md): Exercise the second authentication factor with controlled challenge fixtures and prove password acceptance alone does not unlock protected pages.
- [Verify password login preserves an allowed destination](https://vostride.com/agent-library/authentication/password-login-redirect.md): Test password sign-in from a protected deep link, including account identity, destination preservation, reload behavior, and rejected credentials.
- [Verify remember-me applies the documented session duration](https://vostride.com/agent-library/authentication/remember-me-duration.md): Compare ordinary and remembered sign-in with controlled session inspection and expiry fixtures instead of inferring persistence from checkbox appearance.
- [Verify cancelling SSO returns safely to the application](https://vostride.com/agent-library/authentication/sso-cancel-return.md): Test the cancellation branch of a sandbox identity-provider login and ensure the application preserves a usable signed-out state and retry path.
- [Verify unverified accounts cannot bypass the verification gate](https://vostride.com/agent-library/authentication/unverified-email-gate.md): Exercise sign-in and direct navigation before email verification, then complete a run-specific verification link and confirm the intended access change.

## Apply a recipe

These are test designs to adapt to an application's acceptance criteria and fixtures. They are not recorded runs or a claim that a listed application has been tested. Use the [recipe execution guide](https://vostride.com/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md) to author, validate, run and inspect a test.

[All topics](https://vostride.com/agent-library.md)