---
title: "Verify an MFA challenge rejects a wrong code before accepting a valid one"
description: "Exercise the second authentication factor with controlled challenge fixtures and prove password acceptance alone does not unlock protected pages."
canonical_url: "https://vostride.com/agent-library/authentication/mfa-invalid-then-valid-code.md"
md_url: "https://vostride.com/agent-library/authentication/mfa-invalid-then-valid-code.md"
content_kind: "recipe"
topic: "authentication"
---

# Verify an MFA challenge rejects a wrong code before accepting a valid one

Exercise the second authentication factor with controlled challenge fixtures and prove password acceptance alone does not unlock protected pages.

## Risk

A multi-factor form may display correctly while the application has already granted full access after the password step. This journey checks the authorization boundary before and after the second factor, using controlled nonproduction codes.

## Fixtures

- A test-owned account enrolled in the test environment second-factor mechanism.
- A supported challenge fixture providing a known invalid code and a fresh valid code through secret references.
- A private account page and an application hook reporting whether a full authenticated session exists.

## Steps

1. Submit the account password and verify the second-factor challenge appears with an appropriate masked account hint.
2. Before answering the challenge, open the private account page and verify that it remains blocked by the pending authentication step.
3. Submit the invalid code and verify a clear error, continued challenge visibility, and no authenticated private content.
4. Submit a fresh valid fixture code and verify the private account page and correct account identity are accessible.
5. Run the session inspection hook and verify full authentication was granted only after the valid challenge response; reload the private page to confirm continuity.

## Expected results

- Password acceptance alone does not grant the protected account view.
- An incorrect code does not consume or bypass the required second-factor gate except as explicitly specified by the challenge policy.
- A valid current response completes authentication for the intended account.

## False-pass traps

- A success toast after password submission may describe only the first factor.
- Reusing a captured fully authenticated state prevents this test from observing the MFA boundary.

## Cleanup

- Revoke the scenario session and reset the disposable challenge enrollment if the fixture changed it.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authentication QA recipes](/agent-library/authentication.md)
- [Software factory QA library](/agent-library.md)