1. Enroll current identity
Sign in above, then create and verify a pending enrollment.
MFA enrollment has not started.
Realistic app · Synthetic identities only
Practice Authentication Sandbox
Automate login, registration, reset links, session expiry, role permissions, bearer tokens and API keys without touching a real account system.
Public practice credentials
Demo accounts
Shared fake password: Practice@123. It is intentionally public and must never be reused outside this sandbox.
| Username | Role | Scenario |
|---|---|---|
standard_user | Customer | Normal customer session |
admin_user | Admin | All published permissions |
manager_user | Manager | Reports and ticket updates |
employee_user | Employee | Ticket updates |
readonly_user | Read-only | Mutations disabled |
locked_user | Customer | Always locked |
expired_user | Customer | Forced password change |
slow_user | Customer | Three-second login; ?delay=0 for fast tests |
Cookie session
Sign in
Sign-in has not run.
Server session
Current identity
Account dashboard
Signed out.
- HttpOnly auth cookie
- Readable preference
- Authentication source
- None
No session action.
Sandbox registration
Create a Customer account
No account created.
No real email
Forgot and reset password
No reset requested.
No password reset.
Synthetic mailbox
Practice Inbox
No external message is sent. Reset links exist only in this sandbox.
- Inbox is empty.
Role-based access control
Published permission matrix
| Role | Profile | Orders | Tickets | Reports | Users |
|---|---|---|---|---|---|
| Loading role matrix. | |||||
Admin-only control
Deliberately disabled mutationRead-only users see this disabled; the Admin control is hidden from other roles.
No permission requested.
API authentication
Bearer and refresh tokens
No token issued.
Public synthetic key
API key
No API-key request.
Tab-scoped state
sessionStorage wizard
No wizard state.
Advanced authentication · Synthetic only
MFA and OTP simulation
Enroll a signed-in synthetic identity, request a bounded MFA challenge, verify its public practice OTP, or start a recovery challenge. No SMS, email, authenticator app, external identity provider, or real credential is used.
Public practice OTP: 480321. Public recovery code:RECOVER-4803. Manager and Admin scenarios report an MFA policy of required; other synthetic roles report optional.
2. Request and verify a challenge
No MFA challenge requested.
3. Recovery simulation
Recovery works only after the synthetic identity has enabled MFA in this isolated sandbox.
No recovery challenge requested.
Security learning points
Observe the contract, not secret internals
Passwords are hashed
Only password hashes are stored. The API never returns a password or hash.
CSRF is enforced
Cookie-mode mutations require the same origin and the sandbox CSRF token.
Errors do not enumerate users
Wrong, missing and locked accounts share one sign-in error; forgot-password always gives the same accepted response.
401 and 403 differ
Missing or expired authentication returns 401. A signed-in role without the requested permission returns 403.
const response = await request.post('/practice/api/v1/auth/login', {
data: { username: 'manager_user', password: 'Practice@123', idleSeconds: 300 },
headers: { 'X-Lab-CSRF': csrfToken },
});
expect(response.ok()).toBeTruthy();
await page.goto('/practice/apps/auth/');
await expect(page.getByTestId('signed-in-user')).toContainText('manager_user');