smukh Accessible authentication
Workflow
- Map each available authentication path and its initial, invalid, expired, retry, and successful states. Use test accounts and synthetic codes; preserve the site's security policy.
- Read the authentication review guide for cognitive burden, credential entry, recovery, and policy boundaries.
- Replay whole-value paste, password-manager entry where available, keyboard submission, and error recovery. Record what was actually exercised rather than inferring support from autocomplete markup.
- Repair the source that owns the barrier. Re-run the same path, including failure and retry, and add a behavioral test for the supported input mechanism.
- Follow the guide's manual checks for browser/password-manager and screen-reader behavior; report untested combinations explicitly.
Boundaries
General form labels and validation remain in accessible-forms. This skill owns the complete authentication path, including challenges outside the initial form. Do not remove MFA, weaken rate limits, change account enumeration behavior, or invent a recovery policy. A passing clipboard test does not prove password-manager support or WCAG conformance.