Verifying that invalid credentials are rejected by the part that checks credentials is one thing, and I&#x27;d expect this to be an obvious test case.  But to<p>&gt; verifies that known invalid credentials don&#x27;t permit access<p>you need a second test: &quot;use invalid credentials, then try to download file, expect failure&quot;, i.e. a sequence of actions in a single test.<p>That test is evidently missing from my heating system&#x27;s web interface, which has exactly this problem.  There&#x27;s a box to type in a PIN code, and it lets you proceed &#x2F; retry correctly.  But it&#x27;s not necessary to bother with this, you can change the temperature without authenticating if you know the URL.