Testing and the Launch Checklist

Nothing in identity ships without negative tests. Most teams test that the right password works; attackers test everything else. Use this checklist as a launch gate, and rerun it after every major change.

Test suites to own

Suite	What it covers
Protocol conformance	OpenID Foundation conformance tests for your OP; SAML interoperability with major IdPs
Malicious input	Wrapped SAML signatures, duplicate assertions, alg: none JWTs, wrong aud and iss, expired tokens, replayed codes
WebAuthn	Wrong origin, wrong RP ID, reused challenge, missing UV when required, counter regression, cross-device QR flow
Enumeration	Response body and timing for existing vs non-existing accounts on login, signup, and reset
Rate limits	Per-account, per-IP, global, and per-destination limits under load
Session	Fixation, revocation on reset, sign-out everywhere, cookie attributes
Recovery	Every recovery path with and without MFA enrolled
Load	Normal peak, plus a credential-stuffing burst many times normal
Chaos	Each dependency down in turn (Chapter 15 degraded modes)

Launch checklist

Passwords and credentials

• Argon2id (or PBKDF2 for FIPS) with parameters stored per hash
• Rehash-on-login implemented and tested
• Pepper or hash encryption with keys in KMS, versioned
• No composition rules; length rules per Chapter 5; breached-password checks
• Passwords, codes, and tokens excluded from every log and error tracker

Passkeys and MFA

• RP ID decided and documented; related origins and app associations published
• Passkey autofill on the identifier field; enrollment after sign-in and reset
• TOTP with replay protection and attempt limits
• Recovery codes hashed and single use
• SMS restricted to fallback; push uses number matching

Sessions and tokens

• __Host- cookies with Secure, HttpOnly, SameSite
• Session ID rotated on sign-in and step-up
• Refresh token rotation with reuse detection
• Sign-out everywhere on password change, reset, and recovery

Protocols

• Authorization code with PKCE (S256) only; implicit and password grants disabled
• Exact redirect URI matching; iss returned in authorization responses
• JWKS with kid; rotation rehearsed
• SAML validation checklist (Chapter 10) passing, including malicious samples
• Domain verification before SSO routing

Defense and operations

• Layered rate limits and risk scoring in front of hashing
• Enumeration-safe responses and timing
• CSP, frame-ancestors, HSTS, and no third-party scripts on auth pages
• Security notifications with "this was not me" links
• Audit events from Chapter 17, append-only
• Runbooks from Chapter 18 written and rehearsed
• Third-party penetration test complete, findings fixed

Privacy and residency

• Home region per user and tenant; logs and vendors checked for leaks
• Export and deletion working end to end
• Retention periods documented

Key takeaways

• Identity ships only with negative tests; attackers test everything except the happy path.
• Own conformance, malicious-input, WebAuthn, enumeration, rate-limit, recovery, load, and chaos suites.
• Use the launch checklist as a gate, and rerun it after every major change.