Sign-up and login form test cases
Most lists of login test cases treat the login page on its own. The bugs that hurt users usually sit between the two forms: the sign-up form stores a password or an email one way and the login form reads it another way. So test them as one flow. Create an account, then log in to it, and vary one thing at a time.
Username rules
If usernames are 3 to 20 characters, try 2, 3, 20 and 21. Then the questions the rule may not
answer: are leading and trailing spaces part of the name? Is Anna the same user as
anna? Register one, then the other. If the requirement says usernames are not
case-sensitive, the second should be refused as taken.
Password rules, and what happens to the password afterwards
| At sign-up | Then at login | What it catches |
|---|---|---|
| 7 characters, when the minimum is 8 | - | An off-by-one in the length rule |
| No digit, when one is required | - | A rule checked only on the page, or not at all |
| A long password, 20 to 30 characters | The same password | A sign-up field with a shorter length limit than the login field. The browser cuts the password silently, and the full one never works again. |
| A password with a space at the start or end | The same password, space included | Trimming in one form and not the other |
| Letters with accents, or an emoji | The same password | Encoding differences between the forms |
The middle rows matter most because nothing on the sign-up screen looks wrong. The account is created and the welcome message appears. The bug only shows when the user comes back to log in.
Check the confirm field with a password that differs only in letter case, such as
Secret123 and secret123. They should not match. A strength meter is worth a
minute too: aaaaaaaa should not be rated strong by any reasonable rule.
Email case
Sign up as [email protected] and log in as [email protected]. People type their
address differently on different days and devices, and phones capitalise the first letter on their own.
If login compares the address exactly, those users get "wrong email or password" with the right
password. While you are at it, try an address with a plus sign at sign-up; the
email field guide has the rest.
Age and other limits
For "at least 18", the boundary is a date, not a year. Use a date of birth exactly 18 years ago today (accepted) and 18 years ago tomorrow (rejected, the person is still 17). A check that compares only the year accepts both. The date field guide covers the time-zone side of "today".
Ways in that skip a check
Fill everything in, leave the terms box unticked, and submit three ways: click the button, press Enter in a text field, and tab to the button and press Space. Validation that is attached to the mouse click runs only for the first. Then try a fast double click on the sign-up button and count the accounts. The double submit guide explains what to look for.
Login errors and lockout
Try an email that has no account and a registered email with a wrong password. If the messages differ ("no account with this email" against "wrong password"), anyone can find out who is registered. Unless the requirement says otherwise, both should get the same message.
For a lockout rule like "locked after 5 wrong passwords in a row", count carefully. The 5th wrong attempt should trigger the lock, so the 6th attempt is refused even with the right password. Then check that a correct login resets the count, and that the lock ends when it should.
Where the password travels
Open the developer tools before logging in. On the Network tab, the login request should be a
POST with the password in the body. If it is a GET with the password in the
address, it ends up in browser history and server logs. On the Console tab, nothing should print the
password, not even in a debug message.
What the page echoes back
Welcome messages often repeat the username. Register a username like <b>x</b>
if the rules allow those characters. If it shows up bold, the page inserts your text as HTML, which is
the first step of a cross-site scripting bug. It should show the characters as you typed them.
Open the practice form
More guides: email fields · double submit · all guides