25 login page test cases, including the ones most sets omit

Search for login test cases and you will mostly find valid credentials, invalid password, empty fields and a remember-me check. That is roughly a fifth of the real coverage, and it omits the cases where login actually fails in production.

Account enumeration is the clearest example. If the error for an unregistered email differs from the error for a wrong password, in wording or even in response timing, an attacker can build a list of valid accounts before attempting anything else. It is a one-line test that almost never appears in published sets.

Session behaviour is the second gap. Sign-out that leaves cached authenticated pages reachable through the back button, sessions that outlive their stated timeout, and reset links that work more than once are all common, all high impact, and all invisible to a test set that stops at successful login.

Accessibility is the third. A login form that cannot be completed with a keyboard, or whose validation errors are never announced, locks people out of the product entirely. Three cases cover the essentials, and they belong in the standard set rather than in a separate audit nobody schedules.