Simple Login App

A deliberately small authentication demo: one login form (email + password), a protected /dashboard page that shows who is signed in, and a Sign out button. The session is a signed cookie that lasts 7 days. There is exactly one account (see Test data) and no signup, password reset, or profile pages, so the whole surface is: the redirect from /, the /login form with its error and pending states, the /dashboard guard, and logout. Web only, desktop and mobile browsers. Focus on whether login/logout behaves correctly and predictably, whether the protected page is really protected (direct URLs, Back button, edited cookie), and how the form copes with bad or odd input.

Heads up: Shared demo account: everyone in this round uses the same login, so do not enter any real personal data anywhere. Nothing is purchased and no email is sent. Do not run automated or brute-force credential attacks against the login endpoint; one-off manual wrong-password attempts are fine.

1. 1.Open the test URL in any modern browser (Chrome, Safari, Firefox; phone is fine). You should land on /login.
2. 2.Sign in with the shared test account from Test data (email + password). Email case does not matter.
3. 3.You arrive on /dashboard. That is the whole app. Use Sign out (top right) to end the session.
4. 4.No install and no signup. If the shared account does not work, file that as a finding instead of trying other accounts.

1. 1.Open the test URL. Confirm you are redirected to /login and the form renders correctly (Email, Password, Sign in button).
2. 2.Submit the form empty, then with only an email, then with an invalid email such as "abc". Note what the browser or app shows each time.
3. 3.Enter the test email with a wrong password. Expect the message "Invalid email or password." and nothing else broken. Then open /dashboard directly: you must still be redirected to /login.
4. 4.Enter a wrong email with the correct password. Expect the same generic error; the message must not reveal which field was wrong.
5. 5.Sign in with the correct test account. Confirm you land on /dashboard and it shows the signed-in email.
6. 6.Sign out, then sign in with the email in a different case (e.g. TESTER@QA.NINJA). Login should still succeed and the dashboard should show the lowercase address.
7. 7.While signed in, type /login in the address bar. Expect an immediate redirect to /dashboard. Then open / and expect a redirect to /dashboard too.
8. 8.Reload /dashboard several times and open it in a second tab. You should stay signed in everywhere.
9. 9.Click Sign out. Expect a redirect to /login. Press the browser Back button: /dashboard must not show the old content, you should be sent back to /login.
10. 10.After signing out, type /dashboard directly in the address bar. Expect a redirect to /login.
11. 11.Open browser dev tools > Application (or Storage) > Cookies. Change a few characters of the "session" cookie value, then reload /dashboard. Expect to be treated as signed out (redirect to /login), not an error page.
12. 12.With valid credentials filled in, double-click or rapidly mash the Sign in button. Expect exactly one successful login, no duplicate errors, and no stuck "Signing in..." state.
13. 13.Sign in, close the tab completely, reopen the test URL. Expect to still be signed in (7-day session) and land on /dashboard.
14. 14.Use the app at phone width (a real phone, or resize the window to about 375px). Card, inputs, and button must stay usable with no horizontal scrolling.
15. 15.Navigate the login form with the Tab key only and submit with Enter. Everything should be reachable and operable from the keyboard.
16. 16.Paste a very long string (500+ characters) into the password field and submit. Expect the normal "Invalid email or password." error, not a crash or a timeout.

No findings yet. Be the first to break it.