qa-auth-flows
Authentication flow testing: OAuth 2.0 with PKCE, multi-factor authentication, and session management, plus Keycloak, Auth0 and Okta integration tests. Anchored on RFC 7636, RFC 9700 and OWASP ASVS V3. A critic agent (token-storage-security-critic) flags tokens in localStorage, auth cookies missing httpOnly / Secure / SameSite, and tokens leaking into logs or URLs.
/plugin install qa-auth-flows@testland-qaFirst time? Add the marketplace with /plugin marketplace add testland/qa
- Category
- Integrations & protocols
- Version
v1.3.5- Contents
- 6 skills · 1 agent
- Part of
- qa-role-backend
Skills6
auth0-testsUse when an app uses Auth0 and needs tests for its tenant config, login flows or Action scripts: per-PR or namespaced tenants, Universal Login, PKCE, client credentials, Rules and Hooks, and config drift with a0deploy.skillkeycloak-testsUse whenever an app uses self-hosted Keycloak and needs integration tests: a throwaway Keycloak per test class via Testcontainers, realm JSON imports, OIDC discovery, token and introspection endpoints, the admin REST API, password, auth-code, client-credentials and token-exchange flows, and UMA.skillmfa-flow-test-authorUse when multi-factor login needs automated tests or a new second factor is being added: deterministic TOTP and HOTP codes, SMS or email OTP, WebAuthn passkeys via the Chrome virtual authenticator, recovery codes, enrollment and step-up challenges.skilloauth-flow-test-authorUse whenever an OAuth 2.0 or OpenID Connect client or resource server needs tests, whatever the identity provider: auth code with PKCE, client credentials, refresh-token rotation and reuse detection, state and nonce checks, scopes and strict redirect-URI matching, per the RFCs.skillokta-testsUse when an app uses Okta as its identity provider and needs tests for org config, sign-in policies or Identity Engine flows: per-PR or shared orgs, MFA enforcement, factor enrollment, recovery, SCIM provisioning and least-privilege API tokens.skillsession-management-test-authorUse whenever a web app's session layer needs tests, in any framework: cookie flags (Secure, HttpOnly, SameSite), session ID regeneration on login, idle and absolute timeouts, concurrent-session limits, logout on all devices, CSRF tokens and session binding, per OWASP ASVS V3.skill
Agents1
About qa-auth-flows
Auth flow testing. Three per-IdP skill wrappers (Keycloak, Auth0, Okta) plus two build-an-X workflow skills (oauth-flow-test-author, session-management-test-author) that codify the IdP-independent patterns from RFC 6749 / RFC 7636 PKCE / RFC 9700 Security BCP / OWASP ASVS V3.
Universal in B2B/B2C; high-defect surface. Pairs with qa-shift-left/stride-threat-modeling (planning) - this plugin covers the runtime validation.