A portal is not ready because its administrator can navigate every page. Acceptance should cover separate customer organisations, revoked members, expired invitations and private document links. A polished interface does not compensate for a document leak or access that persists after an employee leaves.
Prepare representative test identities
Create two test organisations with an administrator and member in each. Add a revoked member and an invitation that has not been accepted. Use synthetic or sanitised requests and documents, and write an access matrix before testing. Administrative job titles do not automatically justify access to every customer’s content.
Complete a normal request, then attempt to access it through another organisation’s account. Repeat this through search, export and downloads. Protecting the document screen is insufficient if its storage URL is public.
A repeatable acceptance matrix
| Test | Required result |
|---|---|
| Organisation A opens B’s request URL | Access is denied without exposing the request. |
| Revoked member retries a saved URL | The next request respects revocation policy. |
| Expired or previously accepted invitation | Clear rejection and a safe re-invitation path. |
| Search for another organisation’s document | Neither the result nor a content snippet appears. |
| Export a request set | The same permission boundaries apply as on screen. |
| Receive an email notification | Minimal information and an appropriately authorised destination. |
Specify signed-download expiry separately. Revoking membership does not retrieve a file already downloaded and may not invalidate an unexpired signed URL. Choose controls that match document sensitivity and describe their limits honestly.
Exercise failure recovery
Try an unsupported file type, an oversized upload and a dropped connection during submission. Do not show success until the server has accepted the operation. Repeated submission should have a defined outcome rather than silently producing multiple requests.
Test the same journey on mobile, with a keyboard and in both languages. Errors need actionable text linked to the relevant field, not colour alone. Language switching must preserve the intended content and account context.
Record who accepted what
The process owner, customer representative and security reviewer should each approve their area. Retain the scenario, result, application version and test date without storing real customer documents or passwords in the report. Failed scenarios require a fix or an explicitly reviewed exception before release.
Use this checklist to scope customer portal development. Read the supporting guidance on tenant isolation and data ownership.
Sources and editorial status
- OWASP: authorisation guidance.
- OWASP: file upload guidance.
- Original contribution: cross-organisation acceptance matrix, not a product security certification.
