Test Accounts

Provide test accounts to enable authenticated testing.

• Username/password: Test specific roles (e.g., admin, user).
• Verification URL: A URL that proves authorization, ideally one that is only accessible when authenticated

Guidance: - Create dedicated test accounts with minimal PII. - Do not rotate credentials during the pentest; revoke when testing is complete (but retesting may need the same credentials working).

Supported authentication

SQUR can authenticate through your login using any of these, across multiple user roles:

• Username/password form login with session cookies
• JWT / bearer tokens, including SPA tokens held in local or session storage
• Passwordless email OTP / magic-link (provide access to a test mailbox)
• Password plus an emailed one-time code (email 2FA)

Supported on common flows: OAuth2 / OIDC login via an external IdP (Google, Auth0, Entra) — discovery, hosted login, and the consent screen are handled; best-effort on unusual or MFA-gated IdP flows.

Not supported: SAML SSO, and authenticator-app or hardware MFA (TOTP / FIDO). Provide a role that does not require these, or a token, so testing can proceed.