Cypress auth strategies: UI login vs programmatic session

WHAT THIS TESTS:

Whether you know the difference between testing a feature and setting up state. Interviewers want to see you prioritize fast, isolated tests while still validating critical user paths. They also check if you handle secrets properly and know modern Cypress commands like cy.session.

A GOOD ANSWER COVERS:

Four strategies in order. First, full UI login where you type credentials and click through the form. Use this sparingly, ideally in dedicated login specs, because it is slow, often 3 to 10 seconds per test, and adds flakiness. Second, programmatic login via cy.request to your auth API. This returns a token or cookie that you inject into the browser, cutting setup time to milliseconds. Third, direct state injection by writing to localStorage or calling cy.setCookie when you already know the session shape. Fourth, cy.session, the modern Cypress best practice that caches the authenticated browser state and restores it instantly across tests while still validating it once. Also mention secrets: use cy.env() for tokens and passwords, never hardcode them, and avoid Cypress.expose() for sensitive data since it leaks values to the browser context.

COMMON WRONG ANSWERS:

Insisting that every protected route test must start at the login page to be realistic. Hardcoding passwords or tokens in test files. Not knowing cy.session and instead writing custom localStorage hacks. Confusing cy.env() with Cypress.expose() and accidentally exposing secrets to the application code or developer tools. Saying UI login is faster or more reliable than programmatic methods.

LIKELY FOLLOW-UPS:

How would you handle token refresh during a long test suite? What if your app uses OAuth with a third party provider like Auth0 or Google? How do you keep tests independent when sharing a cached session? When is it acceptable to visit external authentication domains?

ONE CONCRETE EXAMPLE:

In a Next.js app with JWT stored in an HttpOnly cookie, a senior candidate would write a cy.session block inside a custom login command. The setup function sends a cy.request to a test-only API route that returns a valid cookie, then cy.setCookie attaches it. The validate function checks that a profile API call returns 200. Every protected-route test calls this command and gets a restored session in under 100 milliseconds instead of driving the UI for five seconds each time.

Source: docs.cypress.io