What are the six STRIDE questions, actually?
STRIDE isn't complicated. Most explanations just make it sound that way.
Six categories, applied to one component at a time: can someone Spoof an identity here? Tamper with data in transit or at rest? Repudiate an action they took, with no way to prove otherwise? Access information they shouldn't — Information disclosure? Deny service to legitimate users? Elevate their privilege beyond what they should have?
Six questions, one component at a time — that's the whole method.
What does STRIDE look like on a real login form?
Applied to a login form, each letter maps to something concrete and familiar, not abstract theory:
Spoofing is credential stuffing — reusing leaked username/password pairs against your login endpoint. Tampering is a modified request, like altering a hidden form field the client wasn't supposed to be able to change. Repudiation is the absence of an audit log, so a user can plausibly deny an action they actually took. Information disclosure is a verbose error message that tells an attacker whether a username exists in your system. Denial of service is unlimited login attempts with no rate limiting, letting one client exhaust the endpoint. Elevation of privilege is usually the sneakiest one: a broken access check somewhere after successful login, not in the login mechanism itself.
That last one is the pattern worth remembering — teams threat model the login form itself carefully, then wave the post-login access checks through because "they already authenticated." Elevation of privilege lives in that gap far more often than in the authentication step.