Testing cookies, sessions & login: the bugs that ship every week

The web's auth model is full of foot-guns most testers were never taught to look for. Cookies, sessions, tokens, SSO, "remember me," logout edge cases — every one has known failure modes that ship to production constantly because nobody tests them properly. This hands-on half-day teaches those failure modes by having you reproduce them on a deliberately-flawed sandbox. No production system is touched.

This isn't a security course. Security courses teach exploitation; this teaches what auth bugs look like in production behaviour — observable from outside, reproducible without pentesting skills, catchable in a test plan. If you can open the browser Network tab, you can do this workshop. We cover cookies and their flags, the session lifecycle and where it breaks, why logout is the hardest part of auth, permission staleness mid-session, and a live trace of a real OAuth/SSO flow.

You'll walk out with a method, not a badge — an auth test plan you build yourself, plus the four questions that catch most real-world auth bugs in a sprint review. Capped at sixteen seats so the hands-on work actually works. For testers and QA leads who currently sign off on a login flow by clicking "log in" and "log out" once.