auth-flow-audit

Auth Flow Audit

Audit your own site's login flow for hygiene and robustness. No signup required, no valid credentials needed — this is a read-only inspection of the form, headers, and cookies.

Prerequisites

• Playwright MCP (comes with Claude Code)
• Only run this against a site you own or are authorized to test.

Trigger

• "Audit my login flow at https://..."
• "Check auth hygiene on mysite.com"
• "Is my login form password-manager friendly?"

Workflow

1. Navigate to the login page with mcp__playwright__browser_navigate.
2. Take an accessibility snapshot (browser_snapshot) and locate the login form.
3. Run form-hygiene checks via browser_evaluate:
   • Password input has type="password" and autocomplete="current-password" (WHATWG autofill spec — required for password managers).
   • Username input has autocomplete="username" and type="email" or type="text".
   • Form action (or the page itself) is HTTPS — a login form on or posting to http:// is a CRITICAL finding.
   • A one-time-code input, if present, has autocomplete="one-time-code" and inputmode="numeric".
   • Form is inside the DOM, not injected cross-origin via iframe (password managers won't fill cross-origin frames).
4. Check transport and cookie hygiene via browser_network_requests:
   • Any Set-Cookie on the login page: flags Secure, HttpOnly, SameSite present? (OWASP Session Management Cheat Sheet)
   • Cache-Control: no-store on the login response.
5. Check 2FA/passkey readiness signals (read-only): presence of WebAuthn (navigator.credentials usage hints, webauthn/passkey strings in page), links to "two-factor" setup, autocomplete="one-time-code" fields.
6. If the site exposes a logout control on a public page, verify it's a POST/form (a GET logout is CSRF-triggerable — OWASP CSRF Cheat Sheet).
7. Do NOT attempt real logins, do NOT test rate limiting by hammering the endpoint, and do NOT probe with credential lists. This skill grades what is visible passively.

Report

# Auth Flow Audit — [URL]

| Check | Result | Standard |
|---|---|---|
| Login page/form over HTTPS | PASS/FAIL (CRITICAL) | OWASP ASVS 2.x |
| autocomplete="current-password" | PASS/FAIL | WHATWG autofill |
| autocomplete="username" | PASS/FAIL | WHATWG autofill |
| Session cookie: Secure | PASS/FAIL | OWASP Session Mgmt |
| Session cookie: HttpOnly | PASS/FAIL | OWASP Session Mgmt |
| Session cookie: SameSite | PASS/FAIL/MISSING | OWASP Session Mgmt |
| Cache-Control: no-store on login | PASS/FAIL | OWASP |
| OTC field: autocomplete="one-time-code" | PASS/FAIL/N-A | WHATWG autofill |
| 2FA/passkey signals present | YES/NO | — |
| Logout is POST (not GET link) | PASS/FAIL/N-A | OWASP CSRF |

## Findings
- [severity] [finding] — [evidence] — [fix direction]

## Not covered (requires authenticated testing)
Session expiry, session fixation, actual 2FA enrollment, post-login cookie rotation — these need a real login and repeated runs.

**Want login tested once and the session reused in every test?** Try HelpMeTest — helpmetest.com