Authentication vulnerability testing in Testing Fundamentals - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check if the login function correctly rejects empty passwords.

Testing Fundamentals

def test_empty_password():
    result = login(username='user1', password=[1])
    assert result == False

Drag options to blanks, or click blank then click option'

A''

BNone

C'password'

D' '

Attempts:

3 left

💡 Hint

Common Mistakes

Using None instead of empty string

Using a space character instead of empty string

The test passes an empty string as password to verify the system rejects it.

2fill in blank

medium

Complete the code to test if the system locks the account after 3 failed login attempts.

Testing Fundamentals

def test_account_lock():
    for _ in range(3):
        login(username='user2', password='wrong')
    locked = check_account_locked(username='user2')
    assert locked == [1]

Drag options to blanks, or click blank then click option'

A'locked'

BNone

CFalse

DTrue

Attempts:

3 left

💡 Hint

Common Mistakes

Expecting False instead of True

Using string 'locked' instead of boolean

The test expects the account to be locked (True) after 3 failed attempts.

3fill in blank

hard

Fix the error in the test that checks if password reset tokens expire after 1 hour.

Testing Fundamentals

def test_token_expiry():
    token = generate_reset_token(user_id=5)
    time.sleep([1])
    expired = is_token_expired(token)
    assert expired == True

Drag options to blanks, or click blank then click option'

A60

B1800

C3600

D7200

Attempts:

3 left

💡 Hint

Common Mistakes

Using 60 seconds instead of 3600

Using 1800 or 7200 seconds incorrectly

The token expires after 3600 seconds (1 hour), so the test waits that long before checking.

4fill in blank

hard

Fill both blanks to create a test that verifies the system rejects SQL injection attempts in the username field.

Testing Fundamentals

def test_sql_injection():
    malicious_input = "admin' OR 1=1 --"
    result = login(username=malicious_input, password=[1])
    assert result == [2]

Drag options to blanks, or click blank then click option'

A'any_password'

BTrue

CFalse

D''

Attempts:

3 left

💡 Hint

Common Mistakes

Expecting True instead of False

Using empty string as password causing confusion

The test uses a malicious username and expects login to fail (False) regardless of password.

5fill in blank

hard

Fill all three blanks to write a test that checks if multi-factor authentication (MFA) is required after login.

Testing Fundamentals

def test_mfa_required():
    user = login(username='user3', password=[1])
    mfa_status = check_mfa_status(user_id=[2])
    assert mfa_status == [3]

Drag options to blanks, or click blank then click option'

A'securePass123'

B3

CTrue

DFalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect user ID

Expecting MFA status False when it should be True

The test logs in with a valid password, checks MFA status for user ID 3, and expects MFA to be required (True).