Documentation That Validates

---
strategy_id: STR-001
type: test_strategy
title: "Authentication & Login Testing Strategy"
description: "Defines the quality assurance goals, principles, scope, testing types, and tooling strategy for authentication and login functionality in the OWASP GlueUp application. This strategy aligns with OWASP standards and Qualityfolio QA governance."
created_by: "your-email@example.com"
created_at: "2025-10-31"
tags: ["QA strategy", "authentication", "security testing", "OWASP", "functional testing", "automation policy"]
version: "1.0"
status: "Approved"
related_requirements: ["REQ-101", "REQ-102", "REQ-103", "REQ-104"]
---

## 1. Introduction

This **Authentication & Login Testing Strategy** defines the comprehensive approach for validating all authentication modules in the **OWASP GlueUp** application.
It ensures login, credential handling, and session management are tested under functional, non-functional, and security perspectives in compliance with **OWASP guidelines**.

## 2. Testing Goals and Principles

### 2.1 Testing Goals

- Validate authentication and session management functionality across browsers and devices.
- Detect defects related to credential handling, error feedback, and access control.
- Verify compliance with OWASP Authentication and Session Management Cheat Sheets.

### 2.2 Testing Principles

1. **Security First:** Prioritize security over convenience in authentication validation.
2. **Shift-Left QA:** Begin validation at early development stages to reduce risk.
3. **Traceability:** Maintain direct mapping from requirements → plan → cycle → case → evidence.

---
test_suite_id: TS-001
title: "OWASP GlueUp Login Suite"
type: test_suite
strategy: STR-001
test_plan: TP-001
owner: qa.engineer@example.com
description: "This test suite groups all authentication and login-related test plans for the OWASP GlueUp application."
created_by: "your-email@example.com"
created_at: "2025-10-31"
tags: ["authentication", "login", "security", "OWASP compliance", "test suite"]
version: "1.0"
status: "Active"
---

## 1. Introduction

This test suite consolidates all testing activities related to the **Login and Authentication** functionality of the OWASP GlueUp application.

## 2. Scope

The login suite covers:
- Functional validation of login and redirection flow.
- Negative testing for invalid, missing, or malformed inputs.
- Account lockout and brute-force protection behavior.

---
test_plan_id: TP-001
title: "OWASP GlueUp Login Functionality Test Plan"
type: test_plan
parent_id: TS-001
owner: qa.tester@example.com
description: "This test plan defines the approach for validating the login functionality of the OWASP GlueUp application."
created_by: "your-email@example.com"
created_at: "2025-10-31"
tags: ["functional testing", "security testing", "authentication", "login validation"]
version: "1.0"
status: "Active"
---

## 1. Introduction

This test plan outlines the **test approach, objectives, and scope** for verifying the login functionality of the OWASP GlueUp web application.

## 2. Scope of Work

The plan covers the following test areas:
- **Functional Testing:** Successful login and redirection for valid users.
- **Negative Testing:** Validation of invalid, unregistered, and empty input handling.
- **Security & Lockout:** Enforcement of lockout after repeated failed attempts.

---
test_cycle_id: "TCY-0001"
type: test_cycle
test_plan: "TP-001"
test_suite: "TS-001"
strategy: "STR-001"
title: "Cycle 1 - Functional Login Validation"
description: "Functional and security validation cycle for login functionality on OWASP GlueUp application."
created_by: "your-email@example.com"
created_at: "2025-10-31"
approved_by: "approver-email@example.com"
approved_on: "2025-10-31"
tags: ["Functional", "Authentication", "Security", "UI"]
status: "Active"
version: "1.0"
test_cases: ["TC-001", "TC-002", "TC-003", "TC-004", "TC-005", "TC-006"]
---

### Objective
To validate the complete login process of OWASP GlueUp web application, ensuring functional correctness, input validation, session handling, and account lock behavior.

### Scope
Includes:
- Positive authentication flow
- Error handling for invalid inputs
- UI validation (password masking)
- Account lockout behavior

---
test_case_id: "TC-001"
title: "Verify successful login using registered email and correct password"
type: test_case
test_plan: TP-001
created_by: "your-email@example.com"
created_at: "2025-10-30"
approved_by: "approver-email@example.com"
approved_on: "2025-10-30"
test_type: "Manual"
tags: ["Login", "Positive", "Authentication"]
priority: "High"
scenario_type: "happy path"
version: "1.0"
status: "Ready"
---

### Description
Verify that a user can successfully log in using a registered email and the correct password in the OWASP GlueUp application.

### Pre-Conditions
1. User must have a valid registered account on https://owasp.glueup.com/.
2. The account must be active and not locked.

### Test Steps
1. Navigate to https://owasp.glueup.com/account/login.
2. Enter a valid **registered email**.
3. Enter the **correct password**.
4. Click on the **Login** button.

### Expected Result
1. User is successfully authenticated.
2. Redirected to the dashboard or home page.
3. Session remains active until logout or timeout.
4. No error messages displayed.

{
  "case": "TC-001",
  "cycle": "TCY-0001",
  "title": "Verify successful login using registered email and correct password",
  "status": "passed",
  "start_time": "2025-10-30T03:42:23.787Z",
  "end_time": "2025-10-30T03:42:36.474Z",
  "total_duration": "12.69 seconds",
  "steps": [
    {
      "step": 1,
      "stepname": "Navigate to https://owasp.glueup.com/account/login.",
      "status": "passed",
      "start_time": "2025-10-30T03:42:23.792Z",
      "end_time": "2025-10-30T03:42:36.190Z"
    },
    {
      "step": 2,
      "stepname": "Enter a valid **registered email**.",
      "status": "passed",
      "start_time": "2025-10-30T03:42:36.194Z",
      "end_time": "2025-10-30T03:42:36.286Z"
    }
  ]
}

---
run_id: "TCY-0001-TC-001-TR-001"
cycle: "TCY-0001"
test_case_id: "TC-001"
run_date: "2025-10-31"
environment: "Staging"
---

### Actual Result

1. User is successfully authenticated.
2. Redirected to the dashboard.
3. Session remains active until logout or timeout.
4. No error messages displayed.

### Run Summary

- Status: Passed
- Notes: All steps were executed successfully.

---
issue_id: "BUG-TCY-0001-TC-003"
test_case_id: "TC-003"
run_id: "TCY-0001-TC-003-TR-001"
titleName: "Login fails with timeout error even when valid credentials are used"
endpoint: "Login page"
created_by: "your-email@example.com"
created_at: "2025-10-30"
test_type: "Manual"
priority: "High"
severity: "Low"
assigned: "Mahesh"
status: "REJECTED"
---

### Description

During login attempts with valid credentials, the system fails to authenticate the user due to a network timeout.

### Test Steps

Step 1: Launch the application and navigate to the login page.
Step 2: Enter valid credentials and attempt to log in.
Step 3: Simulate network delay or partial disconnection to cause timeout.
Step 4: Observe the system's response.

### Expected Result

1. The system should either retry the request or display a clear "Network Timeout" message.
2. The user should not be shown incorrect "Invalid credentials" error messages.

### Actual Result

1. Login attempt fails with a timeout error.
2. System displays a generic "Login failed" or "Invalid credentials" message.