Reliable E2E Authentication: OIDC/PKCE with AWS Cognito in Cypress | Viola Lykova | Cypress, Nov '25

Talk by Viola Lykova (V Dev) | Cypress | 17 November 2025

Your auth tests are probably lying to you.

If your Cypress tests just drop a fake JWT into localStorage and never touch the real Cognito Hosted UI, they are not testing authentication. They are testing vibes.

This free webinar took place on 17 November 2025 with the support of Cypress.io by Viola Lykova.

In this session I walk through how to make end to end auth testing actually reliable for real apps:
- A fintech platform where users invest, buy loans, and sell holdings
- A health app that tracks 5 a day goals with short token TTL and session expiry

All of this is wired to AWS Cognito using OIDC with PKCE, and tested in Cypress with Cypress Cloud.

What you will learn:
- How OAuth 2.0, OpenID Connect, and PKCE fit together for browser based apps
- How to use AWS Cognito Hosted UI instead of hand rolling fragile login flows
- Why tokens should live in httpOnly, secure cookies, not localStorage
- How to run a real OIDC login flow in Cypress using cy.origin
- How to reuse sessions safely with cy.session to keep suites fast
- How to test short TTL, session expiry, and silent refresh without hacks
- How Cypress Cloud (Replay, parallelisation, status checks) keeps auth green in CI

Tech stack in this video:
- Frontend: Next.js, TypeScript, React
- Auth: AWS Cognito with OIDC + PKCE
- Backend: API protected with JWT validation
- Testing: Cypress, Cypress Cloud

Timestamps:

00:00 Intro - who I am and why auth tests hurt
00:44 Who I am and Why I care?
01:30 The problem - green tests, broken login
04:10 OAuth 2.0, OIDC, PKCE in plain language
09:00 Cognito Hosted UI and sane browser sessions
13:30 Bad auth tests in Cypress - anti patterns
18:00 Fixing it - real login with cy.origin and cy.session
24:30 Short TTL and session expiry demo in the 5 a day app
31:00 Fintech case study - money flows and step up auth
25:00 Using Cypress Cloud for auth suites (Replay, parallel, status checks)

Who this is for:
- Testers and QAs who are tired of flaky login specs and fake tokens
- Frontend devs working with Cognito, OIDC, or other IdPs
- Engineers who need to convince their team to stop bypassing auth in tests

If this was useful:
- Subscribe for more content on testing real world auth flows
- Share it with someone whose tests are still setting localStorage.token

#cypress #testing #aws #cognito #oauth2 #oidc #pkce

Видео Reliable E2E Authentication: OIDC/PKCE with AWS Cognito in Cypress | Viola Lykova | Cypress, Nov '25 канала V Dev