How do I test user registration?
Last checked 31 Aug 2026
Short answer
Sign up with a real and a duplicate email, confirm verification emails arrive, check password rules, and confirm a new account only gets the access it should.
Steps to test
- Register a brand-new account with a real email you can check, using a normal password.
- Confirm the verification email (if email confirmation is enabled) arrives, and that clicking the link actually activates the account rather than erroring.
- Try registering the same email twice — you should get a clear "already registered" message, not a silent duplicate or a crash.
- Test password rules — too short, too weak — and confirm the error message is clear.
- Log out and log back in with the new account to confirm the credentials actually persist.
- Check what a brand-new account can see — it should default to the lowest permission level, never an admin role, unless you explicitly designed an invite/approval flow.
Why the last point matters
Roles must live in a separate user_roles table, and new sign-ups should get a default row (e.g. role = 'user') rather than any assumption of trust. Verify this directly:
Show me what happens in the database when someone registers — confirm a new row is created with the default (non-admin) role, and that a user cannot set their own role.
What usually goes wrong
- Confirmation emails landing in spam or not being sent at all because the email provider isn't fully configured — test with a real inbox, not just checking Supabase's dashboard-equivalent logs.
- A user able to self-elevate their role by editing a client-side request, because the role check only happens in the UI.
- No handling for "email already exists", leading to a confusing generic error.
- Forgetting to test the sign-up flow on mobile, where autofill and keyboard behaviour differ.
See also /questions/how-do-i-test-password-reset and /questions/how-do-i-test-rls.
Was this answer helpful?
Related questions
- AnswerHow do I test forms?Submit every form with valid, invalid and empty data, confirm error messages appear, and check that submitted data actually lands where it should (database, inbox or integration).
- AnswerHow do I test mobile devices?Open the published site on a real phone (or use your browser's device toolbar as a fallback) and check layout, tap targets, forms and navigation at common breakpoints.
- AnswerHow do I test RLS?Try reading and writing data as a different logged-in user and as a logged-out visitor to confirm row-level security actually blocks what it should, rather than assuming the policy is correct.
- AnswerHow do I test SEO?Check that every page has a unique title and meta description, images have alt text, the site generates a sitemap, and preview the page as a search engine or social share would see it.
