> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiptx.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication Testing

> Advanced authentication and session testing configurations

# Authentication Testing

Configure AIPTx to test authenticated areas of your application.

## Authentication Methods

### Bearer Token

```yaml theme={null}
authentication:
  type: bearer
  token: "eyJhbGciOiJIUzI1NiIs..."
```

### Basic Auth

```yaml theme={null}
authentication:
  type: basic
  username: "testuser"
  password: "${TEST_PASSWORD}"
```

### Cookie-Based

```yaml theme={null}
authentication:
  type: cookie
  cookies:
    session_id: "abc123"
    csrf_token: "xyz789"
```

### Custom Headers

```yaml theme={null}
authentication:
  type: custom
  headers:
    Authorization: "Bearer ${TOKEN}"
    X-API-Key: "${API_KEY}"
```

### Login Flow

```yaml theme={null}
authentication:
  type: login
  login_url: "https://app.example.com/api/auth/login"
  method: POST
  body:
    email: "${TEST_EMAIL}"
    password: "${TEST_PASSWORD}"
  success_indicator: "access_token"
  token_extraction:
    type: json
    path: "data.access_token"
  token_usage:
    header: "Authorization"
    prefix: "Bearer "
```

## Multi-User Testing

Test with different user roles:

```yaml theme={null}
authentication:
  users:
    - name: regular_user
      type: bearer
      token: "${USER_TOKEN}"
      roles: [user]

    - name: admin_user
      type: bearer
      token: "${ADMIN_TOKEN}"
      roles: [admin]

    - name: anonymous
      type: none

test_scenarios:
  - user: regular_user
    test: "Can access own resources"
  - user: admin_user
    test: "Can access admin endpoints"
  - user: anonymous
    test: "Cannot access protected endpoints"
```

## Session Testing

### Session Fixation

```yaml theme={null}
session_tests:
  fixation:
    enabled: true
    verify_regeneration: true
```

### Session Timeout

```yaml theme={null}
session_tests:
  timeout:
    enabled: true
    expected_timeout: 3600  # seconds
```

## OAuth/OIDC Testing

```yaml theme={null}
authentication:
  type: oauth2
  flow: authorization_code
  client_id: "${OAUTH_CLIENT_ID}"
  client_secret: "${OAUTH_CLIENT_SECRET}"
  token_url: "https://auth.example.com/oauth/token"
  authorize_url: "https://auth.example.com/oauth/authorize"
  scope: "read write"
```

## JWT Configuration

```yaml theme={null}
jwt_testing:
  enabled: true
  tests:
    - algorithm_none
    - weak_secret
    - expired_token
    - missing_claims
  custom_claims:
    test_privilege_escalation: true
```