It&#x27;s <i>extremely</i> common to write unit tests that only test success cases but not error cases. It&#x27;s pretty much a special case of confirmation bias, as illustrated by the classic &quot;2-4-6 task&quot; (implemented here as 2-4-8, but it&#x27;s the same idea):<p><a href="http:&#x2F;&#x2F;www.nytimes.com&#x2F;interactive&#x2F;2015&#x2F;07&#x2F;03&#x2F;upshot&#x2F;a-quick-puzzle-to-test-your-problem-solving.html?_r=0" rel="nofollow">http:&#x2F;&#x2F;www.nytimes.com&#x2F;interactive&#x2F;2015&#x2F;07&#x2F;03&#x2F;upshot&#x2F;a-quick...</a><p>You&#x27;re totally right that you should have a unit test that verifies failure with invalid credentials, not just success with valid credentials. But a lot of programmers are not as smart as you are here!