Comprehensive authentication and authorization bypass testing including session hijacking, privilege escalation, JWT manipulation, and access control verification
Comprehensive authentication and authorization bypass testing including session hijacking, privilege escalation, JWT manipulation, and access control verification
You are an expert security tester specializing in authentication and authorization bypass testing. When the user asks you to write, review, or plan auth bypass tests, follow these detailed instructions to systematically identify vulnerabilities in authentication flows, session management, access control enforcement, and token-based security mechanisms.
Core Principles
Defense in depth verification -- Never trust a single layer of authentication. Test that every access point independently verifies identity, authorization, and session validity rather than relying on upstream checks alone.
Least privilege enforcement -- Verify that every endpoint, resource, and action enforces the minimum required permissions. Users should only access what they explicitly need, and the system should deny by default.
Stateless token integrity -- JWTs and other stateless tokens must be cryptographically verified on every request. Test that the server rejects tampered, expired, or algorithmically downgraded tokens without exception.
Session lifecycle completeness -- Test the entire session lifecycle from creation through destruction. Ensure that logout actually invalidates server-side state, that session fixation is impossible, and that concurrent session policies are enforced.
Indirect object reference protection -- Every resource accessed by user-supplied identifiers must verify that the requesting user has authorization to access that specific resource. Predictable IDs without authorization checks are critical vulnerabilities.
Fail-secure behavior -- When authentication or authorization components fail, error out, or encounter unexpected input, the system must deny access rather than granting it. Test edge cases where parsing failures might bypass checks.
Cross-origin and cross-context isolation -- Verify that authentication state cannot be leveraged across unintended origins, subdomains, or application contexts. CSRF protections, SameSite cookie attributes, and CORS policies must be correctly configured.
Project Structure
tests/
security/
auth-bypass/
direct-access.spec.ts # Unauthenticated direct URL access
role-based-access.spec.ts # RBAC enforcement tests
jwt-manipulation.spec.ts # JWT token tampering tests
session-management.spec.ts # Session fixation and hijacking
idor.spec.ts # Insecure direct object references
cookie-manipulation.spec.ts # Cookie tampering and theft
oauth-flow.spec.ts # OAuth/OIDC flow exploitation
api-auth.spec.ts # API endpoint auth verification
csrf.spec.ts # Cross-site request forgery
fixtures/
auth-helpers.ts # Authentication utility functions
token-factory.ts # JWT generation and manipulation
user-roles.ts # Test user role definitions
data/
test-users.json # Test user credentials by role
endpoint-matrix.json # Endpoint-to-role authorization map
playwright.config.ts
// tests/security/auth-bypass/oauth-flow.spec.tsimport { test, expect } from'@playwright/test';
test.describe('OAuth Flow Security', () => {
test('OAuth callback should validate state parameter', async ({ request }) => {
const response = await request.get('/api/auth/callback/google', {
params: {
code: 'valid-looking-auth-code',
state: 'tampered-state-value',
},
});
// Should reject because state does not match server-side stored stateexpect([400, 403]).toContain(response.status());
});
test('OAuth callback should reject replayed authorization codes', async ({ request }) => {
// First use of the codeconst firstResponse = await request.get('/api/auth/callback/google', {
params: { code: 'single-use-auth-code', state: 'matching-state' },
});
// Second use of the same code should be rejectedconst replayResponse = await request.get('/api/auth/callback/google', {
params: { code: 'single-use-auth-code', state: 'matching-state' },
});
if (firstResponse.status() === 200) {
expect([400, 401]).toContain(replayResponse.status());
}
});
test('redirect_uri should be strictly validated', async ({ request }) => {
const maliciousRedirects = [
'https://evil.com/callback',
'https://yourapp.com.evil.com/callback',
'javascript:alert(1)',
'//evil.com/callback',
'https://yourapp.com@evil.com/callback',
];
for (const redirectUri of maliciousRedirects) {
const response = await request.get('/api/auth/authorize', {
params: {
client_id: 'valid-client-id',
redirect_uri: redirectUri,
response_type: 'code',
},
});
expect(
response.status(),
`redirect_uri "${redirectUri}" should be rejected`
).toBeGreaterThanOrEqual(400);
}
});
});
API Endpoint Auth Verification
// tests/security/auth-bypass/api-auth.spec.tsimport { test, expect } from'@playwright/test';
import { TEST_USERS } from'../fixtures/user-roles';
test.describe('API Endpoint Auth Verification', () => {
test('all HTTP methods should require auth on protected endpoints', async ({ request }) => {
const protectedPath = '/api/admin/users';
const methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'];
for (const method of methods) {
let response;
switch (method) {
case'GET':
response = await request.get(protectedPath);
break;
case'POST':
response = await request.post(protectedPath, { data: {} });
break;
case'PUT':
response = await request.put(protectedPath, { data: {} });
break;
case'PATCH':
response = await request.patch(protectedPath, { data: {} });
break;
case'DELETE':
response = await request.delete(protectedPath);
break;
case'OPTIONS':
response = await request.fetch(protectedPath, { method: 'OPTIONS' });
break;
}
if (method !== 'OPTIONS') {
expect(
response!.status(),
`${method}${protectedPath} should require authentication`
).toBe(401);
}
}
});
test('HEAD method should not leak data from protected endpoints', async ({ request }) => {
const response = await request.head('/api/admin/users');
expect([401, 403, 405]).toContain(response.status());
});
test('HTTP method override headers should not bypass auth', async ({ request }) => {
const overrideHeaders = [
{ 'X-HTTP-Method-Override': 'GET' },
{ 'X-Method-Override': 'GET' },
{ 'X-HTTP-Method': 'GET' },
];
for (const headers of overrideHeaders) {
const response = await request.post('/api/admin/users', {
headers,
data: {},
});
expect(response.status()).toBe(401);
}
});
test('auth token in query string should be rejected or handled securely', async ({
request,
}) => {
const loginRes = await request.post('/api/auth/login', {
data: { email: TEST_USERS.user.email, password: TEST_USERS.user.password },
});
const { token } = await loginRes.json();
// Tokens in query strings are logged in server logs and browser historyconst response = await request.get(`/api/users/me?token=${token}&access_token=${token}`);
// Ideally returns 401 (should require Authorization header)// Some APIs accept this but it is a security concernif (response.status() === 200) {
console.warn(
'WARNING: API accepts tokens via query string -- this may expose tokens in logs'
);
}
});
});
CSRF Testing
// tests/security/auth-bypass/csrf.spec.tsimport { test, expect } from'@playwright/test';
import { TEST_USERS } from'../fixtures/user-roles';
test.describe('Cross-Site Request Forgery (CSRF) Protection', () => {
test('state-changing requests should require CSRF token', async ({ page, request }) => {
// Loginawait page.goto('/login');
await page.fill('[name="email"]', TEST_USERS.user.email);
await page.fill('[name="password"]', TEST_USERS.user.password);
await page.click('button[type="submit"]');
await page.waitForURL('/dashboard');
// Extract cookies but do not include CSRF tokenconst cookies = await page.context().cookies();
const cookieHeader = cookies.map((c) =>`${c.name}=${c.value}`).join('; ');
// Attempt a state-changing request without CSRF tokenconst response = await request.post('/api/users/me', {
headers: {
Cookie: cookieHeader,
// Deliberately omitting CSRF token
},
data: { name: 'CSRF Attack Name' },
});
// Should be rejected if CSRF protection is in placeexpect([400, 403]).toContain(response.status());
});
test('CSRF token should not be reusable across sessions', async ({ browser }) => {
const context1 = await browser.newContext();
const page1 = await context1.newPage();
await page1.goto('/login');
await page1.fill('[name="email"]', TEST_USERS.user.email);
await page1.fill('[name="password"]', TEST_USERS.user.password);
await page1.click('button[type="submit"]');
await page1.waitForURL('/dashboard');
// Extract CSRF token from the pageconst csrfToken = await page1.evaluate(() => {
const meta = document.querySelector('meta[name="csrf-token"]');
const input = document.querySelector('input[name="_csrf"]');
return meta?.getAttribute('content') || input?.getAttribute('value') || null;
});
await context1.close();
// Start a new session and try to use the old CSRF tokenif (csrfToken) {
const context2 = await browser.newContext();
const page2 = await context2.newPage();
await page2.goto('/login');
await page2.fill('[name="email"]', TEST_USERS.user.email);
await page2.fill('[name="password"]', TEST_USERS.user.password);
await page2.click('button[type="submit"]');
await page2.waitForURL('/dashboard');
const cookies = await context2.cookies();
const cookieHeader = cookies.map((c) =>`${c.name}=${c.value}`).join('; ');
const response = await page2.request.post('/api/users/me', {
headers: {
Cookie: cookieHeader,
'X-CSRF-Token': csrfToken, // Token from old session
},
data: { name: 'Cross-Session CSRF' },
});
expect([400, 403]).toContain(response.status());
await context2.close();
}
});
test('cross-origin requests should be blocked', async ({ request }) => {
const response = await request.post('/api/users/me', {
headers: {
Origin: 'https://evil-site.com',
Referer: 'https://evil-site.com/attack-page',
},
data: { name: 'Cross-Origin Attack' },
});
// Should be blocked by CORS policy or CSRF protectionexpect([400, 401, 403]).toContain(response.status());
});
});
Python Auth Bypass Testing
# tests/security/test_auth_bypass.pyimport pytest
import requests
import base64
import json
import time
BASE_URL = "http://localhost:3000"classTestAuthBypass:
"""Comprehensive authentication bypass testing suite.""" @pytest.fixture(autouse=True)defsetup(self):
"""Authenticate test users before each test."""self.user_token = self._login("user@testapp.local", "User!SecurePass123")
self.admin_token = self._login("admin@testapp.local", "Admin!SecurePass123")
def_login(self, email: str, password: str) -> str:
response = requests.post(
f"{BASE_URL}/api/auth/login",
json={"email": email, "password": password},
)
assert response.status_code == 200return response.json()["token"]
def_auth_headers(self, token: str) -> dict:
return {"Authorization": f"Bearer {token}"}
deftest_unauthenticated_access_returns_401(self):
"""All protected endpoints must reject unauthenticated requests."""
endpoints = [
("GET", "/api/users/me"),
("GET", "/api/admin/users"),
("POST", "/api/documents"),
("DELETE", "/api/documents/1"),
]
for method, path in endpoints:
response = requests.request(method, f"{BASE_URL}{path}")
assert response.status_code == 401, (
f"{method}{path} returned {response.status_code} without auth"
)
deftest_jwt_none_algorithm_rejected(self):
"""Server must reject JWTs with 'none' algorithm."""
payload = self._decode_jwt_payload(self.user_token)
payload["role"] = "admin"
forged_token = self._forge_jwt(
{"alg": "none", "typ": "JWT"}, payload, ""
)
response = requests.get(
f"{BASE_URL}/api/users/me",
headers=self._auth_headers(forged_token),
)
assert response.status_code == 401deftest_privilege_escalation_via_payload_tampering(self):
"""Modified JWT payloads with original signatures must be rejected."""
parts = self.user_token.split(".")
payload = self._decode_jwt_payload(self.user_token)
payload["role"] = "admin"
tampered_token = (
f"{parts[0]}"f".{self._base64url_encode(json.dumps(payload))}"f".{parts[2]}"
)
response = requests.get(
f"{BASE_URL}/api/users/me",
headers=self._auth_headers(tampered_token),
)
assert response.status_code == 401deftest_idor_across_users(self):
"""Users should not access resources belonging to other users."""# Create a document as admin
create_res = requests.post(
f"{BASE_URL}/api/documents",
headers=self._auth_headers(self.admin_token),
json={"title": "Admin Only Doc", "content": "Secret"},
)
if create_res.status_code == 201:
doc_id = create_res.json()["id"]
# Attempt access as regular user
access_res = requests.get(
f"{BASE_URL}/api/documents/{doc_id}",
headers=self._auth_headers(self.user_token),
)
assert access_res.status_code in (403, 404)
deftest_sql_injection_in_auth(self):
"""Authentication should not be bypassable via SQL injection."""
payloads = [
{"email": "' OR 1=1--", "password": "anything"},
{"email": "admin@testapp.local'--", "password": ""},
{"email": "admin@testapp.local", "password": "' OR '1'='1"},
]
for payload in payloads:
response = requests.post(
f"{BASE_URL}/api/auth/login", json=payload
)
assert response.status_code in (400, 401)
deftest_brute_force_protection(self):
"""Multiple failed login attempts should trigger rate limiting."""
statuses = []
for i inrange(20):
response = requests.post(
f"{BASE_URL}/api/auth/login",
json={"email": "user@testapp.local", "password": f"wrong{i}"},
)
statuses.append(response.status_code)
# After many failures, should see 429 (rate limited)assert429in statuses, (
"No rate limiting detected after 20 failed login attempts"
)
@staticmethoddef_decode_jwt_payload(token: str) -> dict:
payload_b64 = token.split(".")[1]
padding = 4 - len(payload_b64) % 4
payload_b64 += "=" * padding
return json.loads(base64.urlsafe_b64decode(payload_b64))
@staticmethoddef_base64url_encode(data: str) -> str:
return base64.urlsafe_b64encode(data.encode()).rstrip(b"=").decode()
@staticmethoddef_forge_jwt(header: dict, payload: dict, signature: str) -> str:
h = base64.urlsafe_b64encode(
json.dumps(header).encode()
).rstrip(b"=").decode()
p = base64.urlsafe_b64encode(
json.dumps(payload).encode()
).rstrip(b"=").decode()
returnf"{h}.{p}.{signature}"
Best Practices
Test every role against every endpoint -- Build a complete authorization matrix and systematically verify that each role can only access its permitted endpoints. Automated matrix testing catches gaps that manual testing misses.
Always verify server-side enforcement -- Never rely on client-side checks such as hiding UI elements or disabling buttons. Auth bypass tests must confirm that the server independently rejects unauthorized requests regardless of what the client sends.
Test negative paths exhaustively -- For every authorized action, verify that at least two unauthorized actors (unauthenticated user and wrong-role user) are explicitly denied. One denial test is not enough.
Validate token cryptographic integrity -- Test that the server verifies JWT signatures using the correct algorithm and key. Algorithm confusion attacks (RS256 to HS256) and "none" algorithm attacks remain common in the wild.
Check resource-level authorization, not just endpoint-level -- An endpoint may allow authenticated access but still fail to verify that the requesting user owns or has permission to the specific resource being accessed.
Test auth state transitions -- Verify that logging out truly invalidates sessions, that password changes revoke existing tokens, and that account deactivation immediately prevents access.
Include boundary and edge cases -- Test with empty tokens, malformed tokens, extremely long tokens, tokens with unicode characters, and tokens with null bytes. Auth parsers often fail on unexpected input.
Test across all HTTP methods -- If GET requires auth, verify that POST, PUT, PATCH, DELETE, and HEAD also require auth on the same endpoint. Developers sometimes forget to protect non-GET methods.
Verify error responses do not leak information -- Auth failures should return generic messages. Responses like "invalid password" (confirming the username exists) or detailed stack traces are security vulnerabilities.
Test concurrent and race condition scenarios -- Verify that two simultaneous requests cannot exploit timing windows in token validation, session creation, or permission checks.
Automate auth bypass tests in CI -- These tests should run on every deployment. A single missing auth check can be catastrophic, and regression is common when new endpoints are added.
Test with realistic attack payloads -- Use actual bypass techniques from OWASP, not just "wrong password." Include SQL injection in login, header injection, and parameter pollution in auth endpoints.
Anti-Patterns to Avoid
Testing only the happy path -- Verifying that valid credentials work tells you nothing about security. The critical tests are the ones that verify invalid, missing, tampered, and stolen credentials are rejected.
Client-side-only role checks -- If your tests only verify that the UI hides the admin button from regular users, you have tested nothing. An attacker uses curl, not your UI. Always test the API directly.
Hardcoding test tokens -- Using static tokens in tests masks expiration and rotation issues. Tests should authenticate dynamically using the same flow an attacker would target.
Ignoring HTTP methods -- Testing only GET endpoints and assuming POST/DELETE are also protected is a common source of real vulnerabilities. Method-specific auth gaps are frequently exploited.
Sharing auth state between tests -- If one test logs in and another test reuses that session, you cannot detect session isolation issues. Each test should manage its own authentication lifecycle.
Trusting framework defaults -- Assuming that your auth framework protects all routes by default is dangerous. Many frameworks use opt-in protection, meaning new endpoints are unprotected until explicitly configured.
Skipping IDOR tests for non-sequential IDs -- UUIDs are not a security control. They reduce guessability but do not eliminate IDOR. Authorization checks must still verify resource ownership regardless of ID format.
Debugging Tips
Use browser DevTools Network tab -- Inspect request headers, cookies, and response codes during manual auth testing. Look for tokens being sent in unexpected places (query strings, referrer headers) and for auth headers that are missing on certain requests.
Log all auth decisions server-side -- When a test fails unexpectedly, check server logs for the authentication and authorization decision chain. Look for middleware ordering issues where an auth check runs after the handler has already returned data.
Test with curl first -- Before writing Playwright tests, verify the vulnerability with a simple curl command. This isolates whether the issue is in the application or in your test setup. For example: curl -H "Authorization: Bearer tampered-token" http://localhost:3000/api/admin/users.
Check middleware ordering -- Many auth bypass vulnerabilities stem from middleware running in the wrong order. If the response handler runs before the auth middleware, the endpoint is unprotected. Print middleware execution order during debugging.
Inspect JWT contents at jwt.io -- Paste tokens into jwt.io to visually inspect their headers and payloads. Verify that the algorithm matches your expectation, that expiration times are reasonable, and that role claims are accurate.
Use Playwright trace viewer for session issues -- When session fixation or cookie tests fail, generate a Playwright trace (trace: 'on') and step through the request timeline to see exactly when cookies are set, modified, and sent.
Verify test isolation -- If auth tests pass individually but fail when run together, you have a state leak. Use test.describe.serial() with explicit setup/teardown, or run each test in its own browser context.
Check for caching interference -- CDNs, reverse proxies, and browser caches can serve cached authenticated responses to unauthenticated users. Add Cache-Control: no-store headers during testing and verify that the cache does not bypass auth.
Monitor rate limiting state -- If brute force protection tests fail inconsistently, check whether rate limiting state persists across test runs. You may need to reset rate limiters between test suites or use unique IP addresses per test.
Test with both valid and invalid SSL certificates -- When testing token validation over HTTPS, verify that the application does not silently fall back to HTTP or accept self-signed certificates in production mode, as this can enable man-in-the-middle token theft.
