Login Flow (login-flow)

Summary

Discovers the login page, analyzes the form, checks HTTPS, tests invalid credentials, and looks for CSRF hints (Playwright).

Classification

• Category: ECOMMERCE
• Plugin id: login-flow
• Version: 1.0.0
• Target types: WEBSHOP
• Weight class: MEDIUM
• Risk level: not set on plugin object
• Browser required: Yes (Playwright)
• Tier / group: Tier 3 — E-commerce / flows (Playwright)

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 4 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
loginUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().
stepTimeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• _secrets — optional login credentials for authenticated checks when applicable.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for login-flow.

Check	Typical severity	Why
Login page not found (paths like /login, /logg-inn, link discovery)	WARNING	Customers cannot authenticate — blocks account, order history, and B2B pricing flows.
Login form incomplete (missing email/username or password field)	WARNING	Unrecognizable forms break password managers and automated accessibility tools.
Login inputs missing accessible labels	WARNING	Screen reader users cannot identify username/password fields.
Inputs missing autocomplete (text/email/password/tel types)	INFO	Without username/current-password, browsers and password managers offer poor UX.
Login page served over HTTP	CRITICAL	Credentials transmitted in cleartext — immediate credential theft risk.
Invalid credentials appear accepted (redirect + authenticated session signals)	CRITICAL	Broken auth may grant access on bad passwords — severe security vulnerability.
Redirect after invalid login without error (no auth signals detected)	INFO	Ambiguous flow — may be custom error handling; needs manual verification.
Login form may lack CSRF token (hidden input name contains csrf/token)	WARNING	Missing CSRF tokens enable cross-site login forgery attacks.
JavaScript errors on login page	WARNING	JS errors can break submit handlers and MFA widgets.

How each check works

1. Discover login URL — Uses loginUrl config or findLoginPageUrl (common paths + homepage links).
2. Analyze form — findLoginForm scores email/username and password inputs; requires both for pass.
3. Accessibility — Lists all visible inputs; flags missing label/aria; INFO for missing autocomplete on text/email/password/tel.
4. HTTPS — CRITICAL finding if final URL does not start with https://.
5. Invalid login test — Fills test-invalid-user@teste.no / invalidP@ssw0rd_test, submits via resilient click, waits 3s. Looks for error keywords (English/Norwegian). If redirected: pageShowsAuthenticatedSession checks logout/account phrases → CRITICAL if true; else INFO redirect-unverified.
6. CSRF — Scans hidden inputs for names containing csrf, token, _token, authenticity → WARNING if none.
7. Defaults and status — timeout 30s, stepTimeout 10s. Status failed if any CRITICAL.

Caveats and concerns

• Does not test valid login — Uses intentionally invalid credentials only (unless secrets injected for other flows).
• Authenticated-session heuristic — False CRITICAL possible if error pages mention “my account”; false INFO on silent redirects.
• CSRF detection is shallow — Header-based or cookie-only CSRF schemes not detected.
• Single login URL — OAuth-only or modal login flows may not be found.
• Secrets redaction — registerSecretsForRedaction scrubs vault values from browser evidence.

Source

packages/test-plugins/src/plugins/login-flow.ts