Logging in
Logging in is vital to many applications, so much so that many standard frameworks provide this functionality. Here, you should use white-box knowledge: how much does your application use a standard framework, and how much have you implemented for yourselves? If you rely entirely on a third-party framework, you can keep your testing brief and focus elsewhere because others have tested and used that code. Even then, you need to check that it has been used correctly, such as requiring a login for all restricted screens. If your application implements most or all logging-in functionality itself, you need a far more comprehensive test plan, as described here.
Logging in comprises two functions: authentication and authorization. Authenticating involves verifying the identity of a user and proving they are who they say they are. Authorization grants access to some parts of your application based on that identity. At a basic level, there may be administrator and user privileges...
