PLAN_015: Password hash comparison during login

Description

This test verifies that during the login process, the device properly hashes the password provided in the request to the login endpoint and compares it with the hash stored in the database for the specified user.

System requirements

This test can be executed with standard hardware, and it is not necessary to use any specific software. Any commonly available system should be sufficient for the task.

Preconditions

• The entire system (including the reverse proxy, REST API, and all upstream services) is deployed, operational, and accessible online.
• All communications with the REST API are conducted over HTTPS, either through a reverse proxy server or directly with the hosting server.
• An entry with at least the following credentials for a test user must exist in the user database:
  • Email: testuser123@legit.health
  • Plaintext password: test@user+123

Input data

Here's the JSON payload that should be included in the request body for this test:

{
  "username": "testuser123@legit.health",
  "password": "test@user+123"
}

Steps

1. Send a POST request to the /login endpoint with the JSON payload from test data.
2. Intercept the login process to ensure that the password provided is hashed using the same hashing algorithm and salt stored in the database. To accomplish this, you can check the server logs or use debugging tools to capture the hashed password and compare it with the stored hashed password in the database.
3. Observe the API response.

Expected outcome

• The login endpoint returns an access token if the username and password are correct. If the password is incorrect, the login process fails without exposing any sensitive information.
• The password provided in the login request is hashed.
• The hash generated from the password provided in the login request matches the stored hashed password.
• The plaintext password is not stored, logged or transmitted at any point during the login process.

Verifies software requirements

• REQ_005

Risk control for

• 26. Data breach or unauthorized access

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Tester: JD-017, JD-009, JD-004
• Approver: JD-005