Given valid username/password
When login
Then status 200

Can an invalid credential create a session?
Can a disabled account authenticate through another path?
Can a token from tenant A be accepted on tenant B route?
Can expired JWT pass because clock skew too large?
Can refresh token rotation race issue two valid children?
Can OAuth callback without matching state login the user?
Can a CSRF request mutate session-authenticated state?
Can logs leak password/reset token/access token?
Can rate limiter be bypassed by casing/tenant/client dimension?

No authenticated principal without validated credential.
No session creation before full authentication and required challenge completion.
No token acceptance without issuer/audience/signature/expiry validation.
No tenant-owned state access without tenant-bound principal.
No refresh token reuse without family revocation.
No user-facing enumeration leak.
No secret in logs.

         Manual adversarial review
       Browser / E2E critical flows
     Protocol / contract tests
   Integration tests with real filter chain
 Unit tests for pure rules and state transitions
 Static checks / dependency checks / secret scanning

@Test
void loginTest() {}

@Test
void login_doesNotCreateSession_whenPasswordIsInvalid() {}

@Test
void jwt_isRejected_whenAudienceDoesNotMatchResourceServer() {}

@Test
void refreshTokenRotation_revokesTokenFamily_whenOldRefreshTokenIsReused() {}

@Test
void passwordReset_returnsGenericResponse_whenAccountDoesNotExist() {}

public final class PasswordLoginService {
    private final AccountRepository accounts;
    private final PasswordVerifier verifier;
    private final RateLimiter rateLimiter;
    private final AuthEventPublisher events;
    private final SessionIssuer sessions;

    public LoginResult login(LoginCommand command) {
        RateLimitDecision limit = rateLimiter.check(command.rateLimitKey());
        if (limit.denied()) {
            events.publish(AuthEvents.rateLimited(command, limit));
            return LoginResult.genericFailure();
        }

        Account account = accounts.findByTenantAndIdentifier(
            command.tenantId(),
            command.identifier()
        ).orElse(Account.synthetic(command.tenantId()));

        PasswordVerification verification = verifier.verify(
            command.rawPassword(),
            account.passwordHash()
        );

        if (!account.exists() || !verification.matched() || !account.canLogin()) {
            events.publish(AuthEvents.loginFailed(command, account, verification.reasonCode()));
            return LoginResult.genericFailure();
        }

        Session session = sessions.issueFor(account);
        events.publish(AuthEvents.loginSucceeded(command, account, session));
        return LoginResult.success(session);
    }
}

class PasswordLoginServiceTest {
    @Test
    void login_returnsGenericFailureAndDoesNotCreateSession_whenAccountDoesNotExist() {
        AccountRepository accounts = new InMemoryAccountRepository();
        RecordingSessionIssuer sessions = new RecordingSessionIssuer();
        RecordingAuthEventPublisher events = new RecordingAuthEventPublisher();

        PasswordLoginService service = new PasswordLoginService(
            accounts,
            PasswordVerifier.syntheticSafe(),
            RateLimiter.allowAll(),
            events,
            sessions
        );

        LoginResult result = service.login(new LoginCommand(
            "tenant-a",
            "missing@example.com",
            "wrong-password",
            "req-1"
        ));

        assertThat(result.outwardStatus()).isEqualTo(LoginOutwardStatus.GENERIC_FAILURE);
        assertThat(sessions.issuedSessions()).isEmpty();
        assertThat(events.single().eventType()).isEqualTo("auth.login.failed");
        assertThat(events.single().reasonCode()).isEqualTo("ACCOUNT_NOT_FOUND_SYNTHETIC_PATH");
    }
}

valid password -> success
wrong password -> generic failure
missing account -> generic failure
locked account -> generic failure
disabled account -> generic failure
expired credential -> generic failure or change-required state
rate-limited account -> generic failure
rate-limited IP -> generic failure
MFA required -> no full session yet
MFA failed -> no full session
MFA passed -> session issued

valid token -> accepted
expired token -> rejected
not-before future -> rejected
wrong audience -> rejected
wrong issuer -> rejected
unknown kid -> rejected
algorithm none -> rejected
HS/RS confusion -> rejected
missing subject -> rejected
wrong typ -> rejected
cross-tenant issuer -> rejected
malformed token -> rejected

login rotates session id
logout invalidates session
old session id cannot access
expired session cannot access
revoked session cannot access
privilege change invalidates or refreshes session authority
CSRF required for state-changing browser requests

@SpringBootTest
@AutoConfigureMockMvc
class LoginSecurityIntegrationTest {
    @Autowired MockMvc mvc;

    @Test
    void protectedEndpoint_redirectsOrRejects_whenAnonymous() throws Exception {
        mvc.perform(get("/account"))
            .andExpect(status().isUnauthorized());
    }
}

import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders.formLogin;
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated;

@Test
void formLogin_authenticates_whenCredentialsAreValid() throws Exception {
    mvc.perform(formLogin("/login")
            .user("username", "alice@example.com")
            .password("password", "correct-password"))
        .andExpect(authenticated());
}

@Test
void formLogin_doesNotAuthenticate_whenPasswordInvalid() throws Exception {
    mvc.perform(formLogin("/login")
            .user("username", "alice@example.com")
            .password("password", "wrong-password"))
        .andExpect(unauthenticated());
}

import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;

@Test
void accountEndpoint_returnsUserData_whenAuthenticated() throws Exception {
    mvc.perform(get("/account").with(user("alice").roles("USER")))
        .andExpect(status().isOk());
}

import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;

@Test
void transfer_isForbidden_withoutCsrfToken() throws Exception {
    mvc.perform(post("/transfer")
            .with(user("alice").roles("USER"))
            .param("amount", "100"))
        .andExpect(status().isForbidden());
}

@Test
void transfer_isAccepted_withValidCsrfToken() throws Exception {
    mvc.perform(post("/transfer")
            .with(user("alice").roles("USER"))
            .with(csrf())
            .param("amount", "100"))
        .andExpect(status().isOk());
}

@Test
void transfer_isForbidden_withInvalidCsrfToken() throws Exception {
    mvc.perform(post("/transfer")
            .with(user("alice").roles("USER"))
            .with(csrf().useInvalidToken()))
        .andExpect(status().isForbidden());
}

Browser ambient authority must be protected on state-changing requests.

@Test
void login_rotatesSessionId_toPreventSessionFixation() throws Exception {
    MockHttpSession preLoginSession = new MockHttpSession();
    String oldId = preLoginSession.getId();

    MvcResult result = mvc.perform(post("/login")
            .session(preLoginSession)
            .param("username", "alice@example.com")
            .param("password", "correct-password")
            .with(csrf()))
        .andExpect(status().is3xxRedirection())
        .andReturn();

    MockHttpSession postLoginSession = (MockHttpSession) result.getRequest().getSession(false);
    assertThat(postLoginSession).isNotNull();
    assertThat(postLoginSession.getId()).isNotEqualTo(oldId);
}

old session no longer grants authenticated access
new session grants access

public final class TestJwtFactory {
    private final RSAPrivateKey privateKey;
    private final String keyId;
    private final String issuer;

    public String token(Consumer<JWTClaimsSet.Builder> customizer) {
        try {
            JWTClaimsSet.Builder claims = new JWTClaimsSet.Builder()
                .issuer(issuer)
                .subject("user-123")
                .audience("orders-api")
                .issueTime(Date.from(Instant.parse("2026-07-03T10:00:00Z")))
                .expirationTime(Date.from(Instant.parse("2026-07-03T10:05:00Z")))
                .jwtID(UUID.randomUUID().toString());

            customizer.accept(claims);

            SignedJWT jwt = new SignedJWT(
                new JWSHeader.Builder(JWSAlgorithm.RS256).keyID(keyId).build(),
                claims.build()
            );
            jwt.sign(new RSASSASigner(privateKey));
            return jwt.serialize();
        } catch (JOSEException e) {
            throw new IllegalStateException(e);
        }
    }
}

@Test
void jwt_isRejected_whenAudienceIsWrong() {
    String token = jwtFactory.token(c -> c.audience("billing-api"));

    assertThatThrownBy(() -> validator.validate(token))
        .isInstanceOf(TokenRejectedException.class)
        .hasMessageContaining("TOKEN_AUDIENCE_INVALID");
}

@Test
void jwt_isRejected_whenExpired() {
    String token = jwtFactory.token(c -> c.expirationTime(
        Date.from(Instant.parse("2026-07-03T09:00:00Z"))
    ));

    assertThatThrownBy(() -> validator.validate(token))
        .isInstanceOf(TokenRejectedException.class)
        .hasMessageContaining("TOKEN_EXPIRED");
}

valid_rs256.jwt
expired.jwt
wrong_audience.jwt
wrong_issuer.jwt
missing_sub.jwt
unknown_kid.jwt
alg_none.jwt
hs_rs_confusion.jwt
malformed.jwt
future_nbf.jwt
wrong_typ.jwt
cross_tenant.jwt

import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.jwt;

@Test
void ordersEndpoint_acceptsJwt_withRequiredScopeAndAudience() throws Exception {
    mvc.perform(get("/orders")
            .with(jwt().jwt(jwt -> jwt
                .issuer("https://idp.example.com/realms/acme")
                .subject("user-123")
                .audience(List.of("orders-api"))
                .claim("tenant_id", "tenant-a")
                .claim("scope", "orders:read"))))
        .andExpect(status().isOk());
}

@Test
void ordersEndpoint_rejectsJwt_withoutRequiredScope() throws Exception {
    mvc.perform(get("/orders")
            .with(jwt().jwt(jwt -> jwt
                .subject("user-123")
                .audience(List.of("orders-api"))
                .claim("scope", "profile"))))
        .andExpect(status().isForbidden());
}

Controller authorization test -> jwt() post-processor OK.
JWT validation correctness -> real token + real JwtDecoder.

valid state + nonce + code -> login success
missing state -> reject
wrong state -> reject
state replay -> reject
missing nonce -> reject
nonce mismatch -> reject
code exchange fails -> generic failure
id token issuer mismatch -> reject
id token audience mismatch -> reject
email same but issuer+sub different -> no auto-link without policy
untrusted redirect after login -> reject

@Test
void oidcCallback_rejects_whenStateDoesNotMatchLoginSession() throws Exception {
    MockHttpSession session = new MockHttpSession();
    session.setAttribute("oauth_state", "expected-state");

    mvc.perform(get("/login/oauth2/code/acme")
            .session(session)
            .param("state", "attacker-state")
            .param("code", "valid-looking-code"))
        .andExpect(status().isUnauthorized());

    assertThat(authEvents)
        .anyMatch(e -> e.eventType().equals("auth.oidc.login.failed")
            && e.reasonCode().equals("OAUTH_STATE_MISMATCH"));
}

Authorization code callback must be bound to the browser login initiation context.

@Test
void canonicalRequest_isStable_forEquivalentHeaderCasing() {
    CanonicalRequest a = canonicalizer.canonicalize(request()
        .method("POST")
        .path("/v1/orders")
        .header("X-Date", "2026-07-03T10:00:00Z")
        .header("Content-Type", "application/json")
        .body("{\"a\":1}")
        .build());

    CanonicalRequest b = canonicalizer.canonicalize(request()
        .method("post")
        .path("/v1/orders")
        .header("x-date", "2026-07-03T10:00:00Z")
        .header("content-type", "application/json")
        .body("{\"a\":1}")
        .build());

    assertThat(a.value()).isEqualTo(b.value());
}

@Test
void signedRequest_isRejected_whenNonceReplayed() {
    SignedRequest request = signedRequestFactory.valid();

    assertThat(verifier.verify(request)).isEqualTo(SignatureDecision.accepted());
    assertThat(verifier.verify(request).reasonCode()).isEqualTo("HMAC_NONCE_REPLAYED");
}

method case
path normalization
query parameter ordering
duplicate query parameter
header casing
header whitespace
body hash
timestamp too old
timestamp too far in future
nonce replay
wrong key id
revoked key
rotated key grace window

@Test
void apiKey_isStoredHashed_notRaw() {
    CreatedApiKey created = service.createKey("tenant-a", "partner-x");

    ApiKeyRecord record = repository.findByPrefix(created.prefix()).orElseThrow();

    assertThat(record.secretHash()).isNotBlank();
    assertThat(record.secretHash()).doesNotContain(created.rawSecret());
    assertThat(record.displayPrefix()).isEqualTo(created.prefix());
}

@Test
void apiKey_authenticates_byPrefixLookupAndConstantVerification() {
    CreatedApiKey key = service.createKey("tenant-a", "partner-x");

    ApiKeyAuthentication result = authenticator.authenticate(key.fullValue());

    assertThat(result.accepted()).isTrue();
    assertThat(result.tenantId()).isEqualTo("tenant-a");
}

@Test
void apiKey_isRejected_afterRevocation() {
    CreatedApiKey key = service.createKey("tenant-a", "partner-x");
    service.revoke(key.keyId());

    assertThat(authenticator.authenticate(key.fullValue()).reasonCode())
        .isEqualTo("API_KEY_REVOKED");
}

@Test
void login_isRateLimited_byAccountAndIpPrefix() {
    LoginCommand command = command("tenant-a", "alice@example.com", "wrong", "203.0.113.10");

    for (int i = 0; i < 5; i++) {
        service.login(command);
    }

    LoginResult result = service.login(command);

    assertThat(result.outwardStatus()).isEqualTo(LoginOutwardStatus.GENERIC_FAILURE);
    assertThat(events.last().eventType()).isEqualTo("auth.rate_limit.exceeded");
    assertThat(events.last().reasonCode()).isEqualTo("RATE_LIMITED_BY_ACCOUNT_IP_PREFIX");
}

email casing changes do not bypass account limit
Unicode confusable identifier does not bypass normalization
same account across tenant respects tenant boundary
IP with different X-Forwarded-For cannot bypass trusted proxy config
client_id dimension applies to OAuth clients
missing tenant does not fall into global unrestricted bucket

status code
response body
error code
redirect location
response time class
email/reset side effect
rate limit behavior
observable public behavior

@Test
void resetPassword_responseIsEquivalent_forExistingAndMissingAccount() throws Exception {
    MvcResult existing = mvc.perform(post("/password/reset")
            .param("email", "alice@example.com"))
        .andExpect(status().isOk())
        .andReturn();

    MvcResult missing = mvc.perform(post("/password/reset")
            .param("email", "missing@example.com"))
        .andExpect(status().isOk())
        .andReturn();

    assertThat(existing.getResponse().getContentAsString())
        .isEqualTo(missing.getResponse().getContentAsString());
}

@Test
void login_usesSyntheticPasswordVerification_whenAccountMissing() {
    SpyPasswordVerifier verifier = new SpyPasswordVerifier();

    service.login(command("missing@example.com", "wrong"));

    assertThat(verifier.invocations()).hasSize(1);
    assertThat(verifier.invocations().getFirst().hashType()).isEqualTo("SYNTHETIC_HASH");
}

read token active
issue child
mark old used

@Test
void refreshRotation_allowsOnlyOneChild_underConcurrentReuse() throws Exception {
    RefreshToken initial = refreshTokens.issueInitial("acct-1", "client-a");

    int concurrency = 20;
    ExecutorService pool = Executors.newFixedThreadPool(concurrency);
    CountDownLatch start = new CountDownLatch(1);

    List<Future<RefreshResult>> futures = IntStream.range(0, concurrency)
        .mapToObj(i -> pool.submit(() -> {
            start.await();
            return service.refresh(initial.rawToken());
        }))
        .toList();

    start.countDown();

    List<RefreshResult> results = new ArrayList<>();
    for (Future<RefreshResult> future : futures) {
        results.add(future.get(5, TimeUnit.SECONDS));
    }

    long successes = results.stream().filter(RefreshResult::succeeded).count();
    long reuses = results.stream()
        .filter(r -> "REFRESH_TOKEN_REUSE_DETECTED".equals(r.reasonCode()))
        .count();

    assertThat(successes).isEqualTo(1);
    assertThat(reuses).isGreaterThanOrEqualTo(1);
    assertThat(refreshTokens.family(initial.familyId()).revoked()).isTrue();
}

token tenant matches route tenant -> accepted
token tenant differs route tenant -> rejected
token issuer tenant differs configured tenant -> rejected
same email in two tenants -> resolves correct membership
session created in tenant A cannot access tenant B
OIDC issuer+sub maps to tenant-specific account
client_id not allowed for tenant -> rejected

@Test
void tenantRoute_rejectsJwtFromDifferentTenant() throws Exception {
    mvc.perform(get("/tenants/tenant-b/orders")
            .with(jwt().jwt(jwt -> jwt
                .subject("user-123")
                .claim("tenant_id", "tenant-a")
                .audience(List.of("orders-api")))))
        .andExpect(status().isForbidden());
}

@Test
void loginFailure_emitsStructuredEvent_withSpecificReasonAndNoSecret() {
    service.login(command("alice@example.com", "wrong-password"));

    AuthEvent event = events.single();

    assertThat(event.eventType()).isEqualTo("auth.login.failed");
    assertThat(event.outcome()).isEqualTo(AuthOutcome.FAILURE);
    assertThat(event.reasonCode()).isEqualTo("PASSWORD_MISMATCH");
    assertThat(event.tenantId()).isEqualTo("tenant-a");

    String serialized = serialize(event);
    assertThat(serialized).doesNotContain("wrong-password");
    assertThat(serialized).doesNotContain("Authorization");
    assertThat(serialized).doesNotContain("refresh_token");
}

@Test
void authLogs_doNotContainRawAccessToken() {
    String token = jwtFactory.validToken();

    mvc.perform(get("/orders")
            .header("Authorization", "Bearer " + token))
        .andExpect(status().isOk());

    assertThat(logCapture.output()).doesNotContain(token);
}

login creates Secure HttpOnly SameSite cookie
logout removes cookie and invalidates server session
back button does not reveal protected page after logout
CSRF token required for mutation
OAuth redirect preserves state
untrusted redirect_uri is rejected
passkey registration works only on valid origin/RP ID

open /login
submit credentials
expect redirected to /dashboard
inspect cookie flags via browser context
click logout
expect /dashboard returns login redirect

components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    apiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key

401 vs 403 semantics
WWW-Authenticate header for bearer token failures
error response does not reveal account existence
OAuth callback accepts required parameters only
password reset response schema is generic
rate limit headers if exposed

@Test
void protectedApi_returnsWwwAuthenticate_whenBearerTokenMissing() throws Exception {
    mvc.perform(get("/api/orders"))
        .andExpect(status().isUnauthorized())
        .andExpect(header().string("WWW-Authenticate", containsString("Bearer")));
}

@Test
void jwtFilter_abortsUnauthorized_whenTokenMissing() throws IOException {
    ContainerRequestContext ctx = mock(ContainerRequestContext.class);
    JwtVerifier verifier = mock(JwtVerifier.class);
    RecordingAuthEventPublisher events = new RecordingAuthEventPublisher();

    JwtAuthenticationFilter filter = new JwtAuthenticationFilter(verifier, events);
    filter.filter(ctx);

    verify(ctx).abortWith(argThat(response -> response.getStatus() == 401));
    assertThat(events.single().reasonCode()).isEqualTo("BEARER_TOKEN_MISSING");
}

identifier normalization
redirect URI validation
HMAC canonical request
scope parser
tenant slug parser
cookie domain/path rule
header parser

For all valid redirect URIs in allowlist,
validator accepts exact URI.
For all URIs with different scheme/host/path confusion,
validator rejects.

@Property
void redirectValidator_rejectsHostSuffixConfusion(@ForAll("attackerHosts") String host) {
    URI uri = URI.create("https://app.example.com." + host + "/callback");

    assertThat(validator.isAllowed(uri)).isFalse();
}

if token.expired -> if not expired
required audience contains -> does not contain
tenant equals -> not equals
rate limit denied -> allowed
session revoked -> not revoked

no logging of Authorization header
no logging of password fields
no use of insecure random for tokens
no hardcoded secrets
no JWT decode without verify
no deprecated crypto algorithms
no missing Secure/HttpOnly cookie flags
no direct string compare for secrets
no broad CORS wildcard with credentials

Spring Security version monitored
JWT/Jose library monitored
Keycloak adapter/library monitored
BouncyCastle/Nimbus monitored
Servlet container monitored

real IdP client secret copied into test property
real private key in repo
real API key format from partner

test-only generated RSA key
test-only client secret
deterministic local JWK set
fake password hash with known parameters
Testcontainers/ephemeral IdP realm

@TestConfiguration
class TestJwtConfiguration {
    @Bean
    JwtDecoder jwtDecoder(TestJwkSet jwkSet) {
        return NimbusJwtDecoder.withPublicKey(jwkSet.publicKey()).build();
    }
}

compile
unit tests
auth domain invariant tests
Spring/Jakarta integration tests
contract tests
security regression tests
dependency vulnerability scan
secret scan
container image scan
selected E2E browser tests

run expanded auth suite
run mutation tests on changed auth packages if feasible
require security/code owner review
require threat-model checklist update if behavior changed

if changed_files contains:
  - src/main/java/**/auth/**
  - src/main/java/**/security/**
  - src/main/resources/application-security*.yml
  - infra/keycloak/**
then run auth-regression-suite

- id: AUTH-REG-001
  title: JWT accepted with wrong audience
  invariant: token audience must include resource server audience
  test: JwtValidatorTest.jwt_isRejected_whenAudienceIsWrong

- id: AUTH-REG-002
  title: Password reset endpoint revealed missing account
  invariant: recovery response must be generic
  test: PasswordResetControllerTest.resetPassword_responseIsEquivalent_forExistingAndMissingAccount

- id: AUTH-REG-003
  title: Refresh rotation race issued two valid children
  invariant: refresh token can be consumed once
  test: RefreshTokenConcurrencyTest.refreshRotation_allowsOnlyOneChild_underConcurrentReuse

[ ] Can I login as disabled/locked/deleted account through alternate flow?
[ ] Can I bypass MFA through password reset or social login?
[ ] Can I reuse OAuth state/code/nonce?
[ ] Can I access tenant B with tenant A token/session?
[ ] Can I use ID token as access token?
[ ] Can I use access token from another client/resource?
[ ] Can I keep session after password/MFA/admin privilege change?
[ ] Can I use old refresh token after rotation?
[ ] Can I enumerate accounts via login/reset/register?
[ ] Can I bypass rate limit by casing, tenant, proxy header, or client_id?
[ ] Are secrets absent from logs, traces, errors, and metrics?
[ ] Does logout remove browser state and server-side/session/token state?
[ ] Does degraded IdP/JWKS/Redis behavior fail safely?

src/test/java/com/acme/auth
├── domain
│   ├── PasswordLoginServiceTest.java
│   ├── LoginStateMachineTest.java
│   ├── RefreshTokenRotationTest.java
│   ├── RiskPolicyTest.java
│   └── IdentifierNormalizationPropertyTest.java
├── spring
│   ├── LoginSecurityIntegrationTest.java
│   ├── CsrfSessionSecurityTest.java
│   ├── ResourceServerSecurityTest.java
│   └── MethodSecurityTest.java
├── protocol
│   ├── JwtValidatorGoldenVectorTest.java
│   ├── HmacCanonicalRequestTest.java
│   ├── OidcCallbackSecurityTest.java
│   └── ApiKeyAuthenticationTest.java
├── tenant
│   ├── TenantAwareJwtValidationTest.java
│   └── TenantSessionIsolationTest.java
├── observability
│   ├── AuthEventEmissionTest.java
│   └── SecretRedactionTest.java
└── regression
    ├── AuthRegressionCatalogTest.java
    └── KnownIncidentRegressionTest.java

Valid authentication paths work.
Invalid authentication paths fail safely.
Ambiguous identity paths are rejected.
State transitions are atomic.
Security events are emitted.
Secrets are not leaked.
Tenant/client/session/token boundaries are enforced.
Known attacks stay fixed.

Do not test that the login page works.
Test that identity cannot be forged, confused, replayed, leaked, or silently misbound.