Loading challenge...
Skip the Login (Storage State)
Log in once then reuse storageState — a login counter and a 5/min 429 expose the cost of per-test login
What you will learn
- Reuse an authenticated session via storageState/cy.session instead of logging in per test
- Recognise that httpOnly session cookies are server-verified (GET ?action=me), not client-readable
- Understand how a per-test login pattern trips a 5/min rate limit (429) and throttles the suite
- Assert on server-gated UI (#secret-area), not on form-visibility heuristics
Skip the Login — Reuse Storage State
Log in ONCE, persist the authenticated cookies, and replay that session across every test instead of logging in per-test
The session is held in an httpOnly cookie, so the client cannot read it directly — it must ask the server via GET /api/lab/login?action=me. The real skill here is saving that authenticated state and reusing it, not retyping credentials in every spec.
Logins so far: … — the endpoint throttles at 5 logins per minute (429), so a naive per-test login will stall the whole suite.
Log In
Demo password is Password123
Testing Tips
Automation hints
- ✓ Log in ONCE in a global-setup step, then save the authenticated cookies with Playwright's
storageState(or Cypresscy.session) and reuse it in every spec — that is the single highest-ROI auth skill - ✓ A naive per-test login through
#email-input/#password-input/#login-buttontrips the 5-per-minute 429 and throttles the whole suite — watch the message in#login-error - ✓
#login-countproves how many real logins happened — with reused storage state it should stay at 0–1 no matter how many tests run - ✓ Assert on
#secret-area(rendered only when the server confirms the cookie), never on the disappearance of the form — the cookie ishttpOnlyso you cannot fake the session client-side - ✓ Use
#reset-button(DELETE) to clear the cookie and counter between runs so your suite starts from a clean, deterministic state
