Testing Multi-Factor Authentication Flows

Verify the secure handoff between password verification and MFA code validation.

In this lesson, you will learn how to verify the secure handoff between password verification and MFA code validation, ensuring that an attacker cannot bypass the second factor by manipulating session states.

The Problem: State Hijacking

A common vulnerability in multi-step authentication is "partial session escalation." If your application grants a temporary session cookie after password validation but fails to properly constrain the permissions of that session until the MFA challenge is complete, an attacker could potentially access restricted routes or administrative functions without ever providing the second factor.

Testing the Handover

To test this, you must treat the authentication flow as a state machine. You need to verify that the server mandates a specific transition: [UNAUTHENTICATED] → [PASSWORD_VERIFIED] → [FULLY_AUTHENTICATED].

Your test suite should assert that the session created after password verification is "crippled" or "limited." It should only allow access to an MFA-validation endpoint and a logout endpoint, while denying access to everything else.

it('should reject access to protected resources after password entry but before MFA', async () => {
  // 1. Password check passed, user gets a partial token
  const partialSession = await loginWithPassword(userCredentials);
  
  // 2. Attempt to hit a protected dashboard route
  const response = await request(app)
    .get('/api/dashboard')
    .set('Cookie', [`session=${partialSession}`]);

  // 3. Assert that access is denied (403 Forbidden or 401 Unauthorized)
  expect(response.status).to.equal(403);
});

Validating the Transition

When you verify the MFA code, your test must confirm that the session token is upgraded or replaced. If you use a JWT, ensure the mfa_verified claim is updated from false to true. If you use server-side sessions, ensure the session object's metadata is updated to reflect the full authentication status. A successful test confirms that the application explicitly invalidates the "partial" state the moment the MFA challenge succeeds, preventing any chance of reuse or scope escalation.

Key Takeaway: A secure MFA handoff must enforce a strictly limited scope for the session between password verification and final MFA validation, which should be verified by attempting to access protected resources during that "gap" state.