Protected Route Access Without Authentication
Verify that unauthenticated users cannot access protected routes and are redirected to login.
Preconditions
- You are not logged in (or have cleared your session/tokens)
- You know URLs for protected routes (e.g., /dashboard, /settings)
Test Steps
Follow each step carefully
Ensure you are logged out
Clear cookies/storage or logout if currently logged in
No authentication tokens present
Directly navigate to a protected URL (e.g., /dashboard)
Type the URL directly in browser address bar
Request is made to the protected route
Observe the redirect behavior
Watch the URL change in the address bar
User is redirected to login page
Verify the original URL is preserved for post-login redirect
Check URL parameters (e.g., ?next=/dashboard)
Return URL is stored for redirect after login
After login, user should be redirected back to the originally requested page
Expected Result
Security enforcement: (1) All protected routes redirect to login when not authenticated, (2) Original destination URL is preserved, (3) After successful login, user is redirected to their intended destination, (4) No protected content is leaked or visible before redirect.
Ready to Complete?
Click when you have verified all steps and the expected result.
Test Info
- Module
- Authentication
- Steps
- 4
- Duration
- 2 min
- XP Value
- +30