Home / Knowledge hub / Authenticated testing
Knowledge hub
Authenticated testing
Testing the parts of an application that only signed-in accounts can reach.
What it means
Authenticated testing means testing an application while signed in. The tester or tool is given valid accounts and uses them to reach pages, actions and API calls that are hidden from the public. Most of a modern product sits behind a login, so most of its risk does too. The question it answers is what a signed-in person can do once inside.
An unauthenticated scan sees the front door and the marketing site. An authenticated test sees the product your customers actually use, including what one account can do to another's data. That includes whether one signed-in account can read or change another account's records.
Why it matters
Flaws behind the login tend to be the costly ones. One customer reading another's invoices, a normal user reaching an admin function, a price changed in the browser and accepted by the server. None are visible to a tool that cannot sign in.
Without it, a clean report can mislead. It says the public pages are fine, and says nothing about the part holding the data. Buyers and auditors increasingly ask whether testing covered authenticated areas, which is the heart of broken access control.
How it shows up
You meet it in scans and pentests configured with credentials, or with a recorded sign-in sequence, and in tests that keep the session alive through token expiry. It needs at least two accounts to check cross-account access, and ideally accounts at different permission levels.
Common problems: the scanner is logged out partway through and carries on unaware, logout and delete links are followed and break the session, and test accounts hold no data. Check that the tool stays signed in, avoid destructive actions in production, and use realistic test data. Often delivered as grey-box testing.
Questions people ask
Authenticated testing, answered
Is authenticated testing the same as grey-box testing?
They overlap. Grey-box usually means the tester has accounts and documents, which is what makes authenticated testing possible.
Authenticated describes what is tested. Grey-box describes how much the tester knows.
How many test accounts do I need?
At least two in separate organisations, so a tester can try to reach one account's data from the other. Add accounts at each permission level.
One account can only test what that account itself can do.
Is it safe to run against production?
It can be, with care. Use dedicated test accounts, avoid actions that delete or spend money, and agree the limits in writing.
A test environment with realistic data is safer.
Why does a scanner lose its session?
Sessions expire, logout links get followed, tokens rotate and anti-forgery values change. The scanner then tests pages as an anonymous visitor without knowing it.
Good setups detect a lost session and sign in again.
Does multi-factor authentication get in the way?
It can. Testers usually need a test account where the second factor is handled, for example a fixed code in a test environment or an agreed bypass for that account only.
Never weaken it for real users to make testing easier.
Sources
Where this comes from
Related
Terms that sit next to this one
Grey-box testing
Testing an app with some inside knowledge, such as accounts and docs, but not the code.
Broken access control
An application failing to enforce its own rules about who may do what.
Cross-account access
One signed-in account reaching another account's data or functions.
Session management
How your app creates, tracks, renews and ends a signed-in visit.
IDOR testing
Swapping record ids between two accounts to see whether the app notices.
What sits behind your login?
We check what each signed-in account can reach that it should not, including one account reading another's data. Each finding carries the request, response and, where visible, a screenshot. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.