QAble

Browse by type

Explore all services
Functional
Functional Testing
End-to-end feature validation
Software Testing
Full-stack QA across disciplines
Software QA
Process, standards & audit QA
Independent Testing
Vendor-neutral V&V & sign-off
Cyber Security Testing
Pen testing & exploit validation
Enterprise Testing
ERP, CRM & core platform QA
Manual Testing
Human-driven QA testing
Exploratory Testing
Discover hidden edge cases
User Acceptance Testing
Business-aligned validation
Usability Testing
Real user experience testing
UI/UX Testing
Interface & interaction QA
Accessibility Testing
WCAG compliance testing
Accessibility Audit
Compliance gap assessment
Accessibility Remediation
Fix accessibility violations
Digital Accessibility
End-to-end inclusive design QA
Security & VAPT
Vulnerability assessment
VAPT Testing
Penetration testing & compliance
Performance Testing
Load & stress testing
Non-Functional Testing
Performance, security & reliability
Compatibility Testing
Cross-device & browser QA
Scalability Testing
Capacity & growth QA
Agile Testing
Sprint-aligned QA
Localization Testing
Language & regional QA
Digital Testing
Digital experience QA

What's New

Solution

Tesbo-X, Playwright Automation Framework

Intelligent test selection, parallel CI execution, and rich trace reporting unified in a single automation system.

Try for Free →
View all services
About UsWhy QAbleCertificationsCareers
Knowledge HubBlogQAble WeeklyCase StudiesEbooksUtilities
BetterBugs
BetterBugs
Tesbo-X
Tesbo-X
Talk to QA Advisor
Browse the Knowledge Hub74 resources
/Test Cases/Forgot password test cases

Test cases

Password reset test cases: an authentication bypass you built on purpose

Twenty six cases covering token expiry, single use enforcement, account enumeration, rate limiting, session invalidation after reset, host header injection, single sign on accounts and two factor interaction. Every case here protects a route into the account.

26cases/7coverage types/13security cases/FreeCSV download

All 26 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

26 worked examples

PWR-01

Request a reset for a registered address

TypeFunctionalPriorityHigh
Test data
Email of an active account
Expected result
Neutral confirmation shown, reset email delivered with a single use link, previous unused tokens for that account invalidated.
PWR-02

Request a reset for an address that is not registered

TypeSecurityPriorityHigh
Test data
Email with no account
Expected result
The same neutral confirmation, the same status code and a comparable response time. No email sent. The response must not reveal whether the account exists.
PWR-03

Compare response timing between existing and unknown addresses

TypeSecurityPriorityHigh
Test data
Twenty requests of each, timed
Expected result
No usable timing difference. Sending mail synchronously for real accounts only is a common and measurable leak.
PWR-04

Complete a reset with a valid token

TypeFunctionalPriorityHigh
Test data
Fresh link, compliant new password
Expected result
Password changed, token consumed, confirmation email sent to the account owner, and the user can sign in with the new password immediately.
PWR-05

Reuse a token that has already been used

TypeSecurityPriorityHigh
Test data
Same link submitted a second time
Expected result
Refused as already used. The password is not changed again.
PWR-06

Use a token after it has expired

TypeBoundaryPriorityHigh
Test data
Just inside the expiry window, then just outside it
Expected result
Accepted inside, refused outside with an offer to request a new link. Expiry should be short, typically under an hour.
PWR-07

Use a tampered or fabricated token

TypeSecurityPriorityHigh
Test data
One character altered, a token from another account, a random string
Expected result
Refused with the same message in every case. Tokens must be long, random and compared in constant time.
PWR-08

Request several resets in a row

TypeSecurityPriorityHigh
Test data
Five requests for the same address in a minute
Expected result
Only the most recent token remains valid, and requests are throttled with a stated wait. Older tokens are invalidated rather than left live.
PWR-09

Rate limit reset requests across accounts

TypeSecurityPriorityHigh
Test data
Requests for fifty different addresses from one source
Expected result
Throttled or challenged. Without this your service is a mail sending tool for someone else.
PWR-10

Brute force the reset endpoint with guessed tokens

TypeSecurityPriorityHigh
Test data
Two hundred submissions with random tokens
Expected result
Blocked or challenged after a small number of failures, and the attempts are logged.
PWR-11

Verify all other sessions are invalidated after a reset

TypeSecurityPriorityHigh
Test data
Sign in on a second browser, then reset the password from the first
Expected result
The second session can no longer act. This is the case that decides whether a reset actually evicts an attacker, and it is the one most often missing.
PWR-12

Verify API tokens and remember me cookies after a reset

TypeSecurityPriorityHigh
Test data
Long lived cookie and a personal access token issued before the reset
Expected result
Handled per a documented policy, and the policy is stated to the user. A remembered device that survives a compromise reset defeats the purpose.
PWR-13

Reject a new password that fails policy

TypeNegativePriorityHigh
Test data
Too short, breached password, the account email as the password
Expected result
Refused with the rule stated, and the token remains valid so the user can try again.
PWR-14

Reject reuse of the current or a recent password

TypeSecurityPriorityMedium
Test data
The existing password, then a password from the stated history window
Expected result
Refused if history rules exist, with the rule explained rather than a generic error.
PWR-15

Confirm password mismatch on the reset form

TypeNegativePriorityMedium
Test data
New password and confirmation differing
Expected result
Blocked with a field level message. Token not consumed.
PWR-16

Reset for an account that is locked, suspended or unverified

TypeStatePriorityHigh
Test data
Each account state in turn
Expected result
Behaviour is deliberate and documented: a reset should not silently unlock a suspended account, and a locked account should be released only if that is the intended design.
PWR-17

Reset an account that uses single sign on

TypeStatePriorityHigh
Test data
Account created through an identity provider with no local password
Expected result
Directed to the provider rather than being given a local password that creates a second, weaker way into the account.
PWR-18

Reset when two factor authentication is enabled

TypeSecurityPriorityHigh
Test data
Account with an authenticator app enrolled
Expected result
The second factor is still required after the reset. A reset must not be a route around two factor authentication.
PWR-19

Change the email address after requesting a reset

TypeStatePriorityHigh
Test data
Request a reset, change the account email in another session, then use the link
Expected result
The token is invalidated by the address change, so a link sent to a previous address cannot be used.
PWR-20

Check the reset link for host header or parameter injection

TypeSecurityPriorityHigh
Test data
Forged Host header and any redirect parameter on the request
Expected result
The link in the email always points at your canonical domain. Host header poisoning that sends a valid token to an attacker domain is a real and repeatedly exploited defect.
PWR-21

Check the token is not leaked through the referrer or analytics

TypeSecurityPriorityHigh
Test data
Open the link, then trigger a third party request from the page
Expected result
The token is not present in outbound referrer headers, analytics payloads or session recordings. Where possible it is exchanged for a short lived server side state on first load.
PWR-22

Verify email content and deliverability

TypeFunctionalPriorityHigh
Test data
Delivery to major providers, plus plain text and HTML rendering
Expected result
Arrives without going to spam, renders in both formats, states the expiry, names the requesting product, and includes a note about what to do if the request was not made by the recipient.
PWR-23

Behaviour when the email provider fails

TypeNegativePriorityHigh
Test data
Mail service erroring or timing out
Expected result
The user still sees the neutral confirmation, the failure is logged and retried, and no error message reveals whether the address existed.
PWR-24

Open the reset link on a different device or browser

TypeCompatibilityPriorityHigh
Test data
Request on desktop, open the link on mobile
Expected result
Works. The flow must not depend on session state from the requesting browser, which is a common failure when the token is tied to a session cookie.
PWR-25

Verify the reset notification reaches the owner

TypeFunctionalPriorityHigh
Test data
Complete a reset and check the account email
Expected result
A confirmation of the change is sent, including time and approximate location if available, so an unauthorised reset is visible to the real owner.
PWR-26

Complete the flow by keyboard and screen reader

TypeAccessibilityPriorityHigh
Test data
Keyboard only, then NVDA or VoiceOver
Expected result
Fields labelled, errors announced and associated with their field, password visibility toggle reachable and announced, and paste permitted so password managers work.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based. Everything about token validity, reuse, enumeration and session invalidation is High. This flow is a deliberate authentication bypass, so a weakness here is an account takeover.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Reset in one browser, act in another

If the second session still works after a reset, the flow does not do the one job it exists for.

Check other sessions die

Sign in twice, reset from one, then act from the other. A reset that leaves sessions alive cannot evict an attacker.

Compare the two responses

Registered and unregistered addresses must produce the same message, status and timing.

Forge the Host header

If the emailed link is built from the request host, an attacker can have a valid token sent to their own domain.

Open the link elsewhere

Request on desktop, open on mobile. Tokens tied to the requesting session break for most real users.

What Most Sets Miss

The reset cases that decide account security

Session invalidation is the most commonly missing case, and it defeats the purpose of the whole feature when it is absent. The usual reason a user resets a password is that they believe someone else has access. If existing sessions, remember me cookies and API tokens survive the reset, the intruder keeps their access and the user believes they are safe. Test with two live sessions and assert the second one is evicted.

Host header injection is the classic technical flaw here. Where the reset link is constructed from the incoming request host rather than a configured canonical domain, an attacker can trigger a reset for a victim and have the email arrive containing a link pointing at their own server, which captures a valid token. Send a forged Host header and read the resulting email.

Enumeration on this flow is easier to leak than on login, because the honest message is tempting. Any difference in wording, status code or response time between a registered and an unregistered address hands over an account list. Sending mail synchronously only for real accounts creates a timing difference you can measure with twenty requests.

Two cases worth adding that are rarely written: what a reset does to an account created through single sign on, where issuing a local password quietly creates a second and weaker way in, and whether a reset bypasses two factor authentication. Both are design decisions that need asserting rather than assuming.

Suggest an improvement

Authentication under review?

QAble tests login, reset, session handling and two factor flows together, including the API level cases that never appear in the interface.

Security testing services

More test case sets

View all

Test cases for a login page

Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for a registration form

Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.

Test cases for search functionality

Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for OTP verification

Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.

Test cases for user roles and permissions

Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for form validation

Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.

Test cases for a date picker

Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for push notifications

Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.

Test cases for reports and data export

Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.

Test cases for a chatbot

Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for subscription and billing

Test cases28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.

Test cases for data tables, filters and sorting

Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for performance and load

Test cases28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.

Test cases for the OWASP Top 10

Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Test cases for outbound webhooks

Test cases28 cases on retry backoff and dead letter stores, one dead consumer degrading the pipeline, payload signing and replay windows, out of order delivery and endpoint SSRF.

Test cases for background jobs and queues

Test cases28 cases on work outliving the visibility timeout, idempotent handlers, poison messages, priority starvation, scheduler overlap across instances and graceful drain.

Test cases for real time features and websockets

Test cases28 cases on messages lost in the reconnect gap, half open connections, per channel authorisation, tokens expiring mid connection, backpressure and fanout across instances.

Test cases for file storage and media processing

Test cases28 cases on signed URL scope and expiry, serving before scanning completes, content type sniffing, metadata stripping, orphaned objects and derivative failures.

Test cases for CSV import and bulk operations

Test cases28 cases on reruns duplicating successes, delimiters inside quoted fields, byte order marks, leading zeros, ambiguous dates and bulk action scope.

Test cases for feature flags and progressive rollout

Test cases28 cases on unreachable flag services, unstable bucketing, rollouts that reshuffle users, kill switch latency, server and client mismatch and stale flags.

Test cases for Android app lifecycle and permissions

Test cases28 cases on state lost to process death, configuration changes, permanent permission denial, revocation while backgrounded, doze and battery restrictions.

Test cases for iOS app lifecycle and permissions

Test cases28 cases on the keychain surviving uninstall, suspended termination, limited photo access, allow once location, app switcher snapshots and biometric invalidation.

Test cases for wearable app sync

Test cases28 cases on data recorded away from the phone, duplicate records on resync, full buffers, clock drift, health permissions, battery budgets and unworn readings.

Test cases for VR and AR experiences

Test cases28 cases on the frame rate comfort floor, tracking loss, guardian boundaries, involuntary camera movement, AR anchor drift and spatial data privacy.

Test cases for IoT device pairing and telemetry

Test cases28 cases on offline buffering and reconnect floods, fleet wide reconnection storms, shared credentials, wrong device clocks and stale queued commands.

Test cases for embedded firmware update

Test cases28 cases on power loss mid write, automatic rollback and health confirmation, signature and anti rollback checks, staged rollouts and recovery mode.

Test cases for user profile and account settings

Test cases28 cases on partial saves reported as success, optimistic updates the server rejected, mass assignment through a profile form, avatar content inspection and session invalidation.

Test cases for account deletion and data export

Test cases28 cases on export links that must be authorised and expiring, deletion cascading to storage, caches, logs and processors, grace periods, legal holds and deadlines.

Test cases for consent and cookie management

Test cases28 cases on cookies and tracking requests firing before consent, reject parity with accept, tag manager bypass, withdrawal, cached banners and server side forwarding.

Test cases for notification preferences and delivery

Test cases28 cases on opt outs honoured on one channel and ignored on another, marketing sent as transactional, unsubscribe scope, imports resetting consent and digest timezones.

Test cases for admin impersonation and support access

Test cases28 cases on actions attributed to the customer instead of the admin, credential exposure, chained and upward impersonation, session expiry and immutable access records.

Test cases for audit logs and activity history

Test cases28 cases on forged entries through log injection, immutability and tamper detection, actor attribution across impersonation and jobs, retention and legal holds.

Sources

Want account recovery tested like an attack path?

QAble covers authentication and session security with ISTQB-certified engineers. Start with a free QA audit of your product.

Talk to QA Advisor