Recently, human behavior sensing based on WiFi channel state information has drawn more attention in the ubiquitous computing field because it can provide accurate information about the target under a device-free scheme. This paper concentrates on user authentication applications using channel state information. We investigate state-of-the-art studies and survey their characteristics. First, we introduce the concept of channel state information and outline the fundamental principle of user authentication. These systems measure the dynamic channel state information profile and implement user authentication by exploring the channel state information variation caused by users because each user generates unique channel state information fluctuations. Second, we elaborate on signal processing approaches, including signal selection and preprocessing, feature extraction, and classification methods. Third, we thoroughly investigate the latest user authentication applications. Specifically, we analyze these applications from typical human action, including gait, activity, gesture, and stillness. Finally, we provide a comprehensive discussion of user authentication and conclude the paper by presenting some open issues, research directions, and possible solutions.