We've got a web application which is 99% complete prior to public beta, were currenlty securing the site from security perspective, locking down the server, db etc, one thing I'm concerned about but not really sure of the best way to test is for authentication loop holes.
For instance there a 3 user types - System admin, Staff, Client.
There are urls on the site that I would only want the System admin to be able to access, and there are other pages, that I would want everyone to access, but not view all of the data. System admin would be able to see everything, but Staff and Client would be able to see some content, similarly some pages would be read only for some users.
Is there a workflow for testing this, at the moment I've come up with a script that has the credentials of a each user type and goes to every url on the site trying to access pages and reports if it's able to see a page it's not meant to, similarly it checks for read / write data on the page.
- Is there anything else I should be checking for to make my authentication tests more robust ?