Category 3 of 10
Auth and sessions
Identity is checked on the server for every protected route and mutation; login surfaces resist abuse.
v1.0 · verified on 2026-09-21
The browser is not a boundary. These items call routes and actions directly, out of order and without cookies.
Every protected route verifies the session server-side
automated Request every route marked protected without cookies and with an expired session.
Every protected route returns 401, 403 or a redirect to login; none returns protected content.
Server actions and API mutations re-check authentication and authorization
automated Invoke each server action or mutation endpoint directly by POST, without a session and with another user's session.
Every mutation rejects the unauthenticated call and the foreign-user call.
Auth endpoints cannot be used out of order
manual Call register, verify, reset and invite endpoints out of sequence and with ids or tokens taken from public files.
No endpoint creates a verified account or resets a credential without the intended prior step.
Login and code-entry endpoints are rate-limited with a lockout rule
automated Send 20 failed attempts within 60 seconds to login, OTP and password reset.
Attempts are refused before the 20th, and the refusal is logged with the account or address.
State-changing requests are protected against cross-site request forgery
automated Submit a state-changing request from a page on another origin with the victim's cookies present.
The request is rejected (origin check, SameSite cookie or token) for every tested mutation.
Sessions end on logout and on password change
manual Keep a second browser signed in; log out and change the password in the first; retry a protected request in the second.
The second browser is signed out after both events.
User-supplied content renders inert
automated Submit script, event-handler and URL payloads through every free-text field and view every screen that displays them.
No payload executes on any screen; content displays as text.
Dots: Starter, Growth, Scale. Compare plan limits.
Failure patterns these items catch
- criticalProtected route checked only in the browser
A redirect in client code hides the page from signed-out users while the data endpoint behind it answers anyone.
- criticalServer action without its own auth check
The page checks the session, but the exported action it calls does not, and actions can be invoked by direct POST.
- criticalRegistration or verification endpoint usable without prerequisites
An endpoint in the sign-up or verification flow accepts calls out of order, so an account can be created or verified without the intended step.
- highLogin and code entry without rate limits
Passwords and one-time codes can be guessed at machine speed because nothing counts attempts.
- highState-changing request accepted from another origin
A form or endpoint changes data on a cookie-authenticated request without checking where the request came from.
- highSession survives logout or password change
Other devices stay signed in after the user logs out or changes their password.
- highUser content rendered as markup
Text a user typed is inserted into the page as HTML, so a script in a name or comment runs in other users' browsers and can take their session.
Ask which plan runs these items
Email with your team size, cadence and stacks. We reply within 24 hours on business days.