---
title: "Verify password login preserves an allowed destination"
description: "Test password sign-in from a protected deep link, including account identity, destination preservation, reload behavior, and rejected credentials."
canonical_url: "https://vostride.com/agent-library/authentication/password-login-redirect.md"
md_url: "https://vostride.com/agent-library/authentication/password-login-redirect.md"
content_kind: "recipe"
topic: "authentication"
---

# Verify password login preserves an allowed destination

Test password sign-in from a protected deep link, including account identity, destination preservation, reload behavior, and rejected credentials.

## Risk

A login page can appear successful while losing the requested destination, loading the wrong workspace, or exposing protected content before authentication. This recipe proves the whole transition using a private record with an unmistakable fixture label.

## Fixtures

- A test-owned verified account with its password supplied through a secret reference.
- A private project named QA Login Destination in a workspace accessible only to this account.
- A clean signed-out browser and an application-specific session inspection hook that reports identity without returning tokens.

## Steps

1. Open the private project URL while signed out and verify the sign-in page appears without the project description.
2. Submit the correct email with a deliberately wrong fixture password; verify a visible authentication error and that the private project remains inaccessible.
3. Enter the valid secret and submit once; verify the resulting page shows QA Login Destination and the correct workspace name.
4. Open the account menu and verify the signed-in email matches the fixture; reload the project and verify its private description remains accessible.
5. Run the registered session inspection hook and verify its exported account identifier equals the fixture account identifier.

## Expected results

- The rejected attempt creates no authenticated session according to the inspection hook.
- Successful authentication returns to the exact allowed private project rather than an unrelated dashboard.
- Account identity and workspace context remain correct after a full reload.

## False-pass traps

- A navigation away from the login form alone does not prove that authentication succeeded.
- A previously captured auth state would bypass the password journey and can conceal a broken credential check.

## Cleanup

- Sign out and remove only the private fixture project if it was created for this run.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authentication QA recipes](/agent-library/authentication.md)
- [Software factory QA library](/agent-library.md)