Authentication Testing

Auth Testing Strategies

Reserve UI login tests for the login feature itself. For other specs, authenticate via API and save cookies/localStorage to a file, then load with storageState in config.

Multi-role testing uses separate storageState files: admin.json, user.json, and different projects or tests.

// auth.setup.ts
import { test as setup } from '@playwright/test';
setup('authenticate', async ({ page }) => {
  await page.goto('/login');
  await page.getByLabel('Email').fill(process.env.TEST_USER!);
  await page.getByLabel('Password').fill(process.env.TEST_PASSWORD!);
  await page.getByRole('button', { name: 'Sign in' }).click();
  await page.context().storageState({ path: 'auth/user.json' });
});

Setup project runs once per worker; tests reuse auth/user.json.

Config Wiring

projects: [
  { name: 'setup', testMatch: 'auth.setup.ts' },
  { name: 'chromium', use: { storageState: 'auth/user.json' }, dependencies: ['setup'] },
]

• Setup project generates storageState before dependent projects.
• API login in setup is faster than UI when endpoints exist.
• Never commit storageState with live production tokens.
• OAuth may need real IdP test tenant or mocked token endpoint.

Authentication Patterns

Choose strategy by scenario.

OAuth and SSO

Third-party OAuth flows are slow and flaky in CI. Prefer test IdP, auth bypass route in dev builds, or inject session cookies via storageState prepared by backend test helper.

globalSetup for One-Time Login

Run authentication once in globalSetup, save storageState, and reference it in config use — every test starts authenticated without per-file setup.

Common Mistakes

• UI login in every test — 10x suite runtime.
• Committed storageState files with secrets.
• Same auth file for tests that mutate user profile concurrently.
• Not testing logout/session expiry at all.

Key Takeaways

• Reuse auth via storageState and setup projects.
• UI login tests focus on login; other specs skip UI auth.
• Separate storage files per role.
• OAuth needs special test environment handling.