A Login page is more than just a place for users to access their account. It is a critical page to adhere to security, privacy, and even personalization best practices. This page is always a strong point of focus when conducting software testing or web testing. If you are trying to test your login page and don’t know where to start, read on and discover 100 test cases for Login Page that you can use for references.
In this article, we will list out the most common and essential test cases for the Login page and categorize them in groups. We also include a test case template for you to get started more quickly.
Read More: A Complete Web Testing Checklist
Positive test cases are test cases that follow the “happy path” i.e. testing if the Login page functions as expected under valid inputs. These test cases explore scenarios where users do what they are supposed to do, such as:
In contrast, negative testing for the Login page aims to explore scenarios that deviate from that “happy path”. Users don’t always do what we want them to do. Sometimes they do unexpected things, and a good tester understands that unpredictability to test accordingly. Some common negative test cases you should test on your Login page include:
With negative testing, you have to be creative. The more complex your login and authentication process is, the more test cases you will need to perform. Put yourself in the shoes of a user who has never interacted with the system before. Be a person that makes mistakes all the time and simply think of all the “bad” possibilities that can happen in your system, or specifically your Login page.
Performance testing checks if the Login page can handle various levels of traffic and user visits. While all websites should have good loading speed and can handle large volumes of traffic to this page, certain types of websites should pay more attention to its performance than others, especially websites that receive a massive amount of traffic.
For example, eCommerce websites rely quite heavily on strong performance. Slow loading time on the Login page means lost revenue. Similarly, public services and financial institutions expected to be up and running 24/7 must also ensure that their system can withstand sudden spikes in traffic.
Educational institutions usually don’t also experience large volumes of traffic to the Login page during the school year, but in enrollment seasons, it skyrockets, and performance testing here provides data to make informed decisions on web resource optimization.
Here are some performance test cases for Login page:
Read More: Performance Testing vs Load Testing
The Login page is considered to be the first layer of security for many systems. Its role is primarily for access control and user authentication. Through this page, developers can have a better control of what data users get to access.
For example, in membership sites, the Login page can be the “gate” separating subscribers and non-subscribers. Team members have a separate Login page where they can type in their credentials to access the system’s backend. That’s why security testing for the Login page is especially important.
Usually security testing are performed in-house, but sometimes an external security testing team can also be requested to come in and launch an authorized attack on the system to identify vulnerabilities, which is usually known as penetration testing.
Below are 15 popular security test cases for the Login page:
SQL Injection is when malicious SQL code is inserted into input fields or data inputs of a web application to destroy your database. This is one of the most common web hacking techniques currently, although it has been around for more than 2 decades.
Suppose there is a login page for a website that checks the entered username and password against a database of user credentials using SQL queries. The login page URL is: “https://example.com/login”.
Backend code that does not properly validate user inputs will be highly vulnerable to such attacks.. Here's a simplified representation of the vulnerable code written in Python using SQL:
username = get_user_input() # Simulated user input
password = get_user_input() # Simulated user input
# Constructing the SQL query
query = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
In the code snippet above, there are 2 vulnerabilities:
An attacker can exploit those vulnerabilities to bypass the login and potentially gain unauthorized access to the system in 2 steps::
The constructed SQL query would look like this:
SELECT * FROM users WHERE username='user' AND password='' OR '1'='1'
In SQL, '1'='1' is always true, so this modified query effectively bypasses the password check. The application retrieves all records where the username is 'user' and where '1' is equal to '1', which will match all rows.
The attacker successfully logs in without knowing the correct password because the SQL query always evaluates to true. After that, depending on the application's functionality and the attacker's goals, they can manipulate or extract sensitive data from the database. The impact can be irreversible.
Read More: What is Database Testing?
Here are several SQL injection test cases you can try on your Login page:
Test cases for Gmail Login page is similar to any other types of Login page:
Read More: 100 Test Cases For Registration Page
Here we venture towards the domain of mobile testing, which comes with their own unique challenges. For one, these devices have a wide range of models, screen resolutions, as well as mobile-only technologies that testers need to take into account. Here are several login page test cases for mobile apps in particular:
Read More: Top API Test Cases You Should Test
BDD testing is just an approach where testers write test cases in simple language (usually Gherkin) that even people without technical expertise can understand. Usually a BDD test case is structured in 3 statements:
Here are 15 test cases for Login page written in Gherkin format:
Test Case 1: Successful Login
Given a valid username and password,
When I attempt to log in,
Then I should be successfully logged into the system.
Test Case 2: Invalid Password
Given an invalid password for a valid username,
When I attempt to log in,
Then I should see an error message indicating the incorrect password.
Test Case 3: Empty Username Field
Given an empty username field,
When I attempt to log in,
Then I should see an error message indicating the username field is required.
Test Case 4: Empty Password Field
Given an empty password field,
When I attempt to log in,
Then I should see an error message indicating the password field is required.
Test Case 5: Username with Special Characters
Given a username with special characters,
When I attempt to log in,
Then I should successfully log in.
Test Case 6: Locked Account
Given a locked account due to multiple failed login attempts,
When I attempt to log in,
Then I should see an error message indicating that my account is locked.
Test Case 7: Remember Me Option
Given a valid username and password with "Remember Me" selected,
When I log in,
Then I should remain logged in across sessions.
Test Case 8: Multi-Factor Authentication (MFA)
Given a valid username and password with multi-factor authentication (MFA) enabled,
When I log in,
Then I should be prompted to enter an authentication code.
Test Case 9: Password Reset Request
Given a password reset request,
When I follow the password reset process,
Then I should be able to set a new password.
Test Case 10: Account Recovery Request
Given an account recovery request,
When I follow the account recovery process,
Then I should be able to regain access to my account.
To best write your test cases, you should always have a test case template, which we have prepared in PDF, Doc, and Excel sheet formats for you to download. Simply hit the button below and start noting down your test cases right away.
Or Manage All Test Cases in Katalon TestOps
Login page testing is not incredibly complex, but it is highly repetitive by nature. It is always a crucial page, and frequent regression testing for it is a must. Automating test cases on Login page is a great strategy, but writing test scripts from scratch then continuously maintaining them after each code change is actually quite counterproductive.
With Katalon Platform, you can easily create, manage, execute, maintain, and generate report for your test cases and test projects all in 1 place, without having to install or switch to any additional tech.
For example, you can use its Record-and-Playback feature to easily capture what you are doing on the Login page, and Katalon turns it into a full test script that you can just execute whenever you want. With just a few seconds, you have successfully automated your testing for the Login page.
As you will see in the video here, all you have to do is clicking on the “Make an Appoitment” button, and Katalon will register your action, turn it into code, which is executed (aka Playback) when you click “Run”:
Even if changes occur on this page, Katalon will intelligently and automatically fix the outdated test script by updating the locators of on-screen elements based on the changes it detected thanks to its Self-healing features. Combining all of that with the industry-leading AI-powered testing features, you have a comprehensive software quality management platform that is highly scalable and innovative.
Start Testing With Katalon (Free)