1. What Is Web Application Testing?
Web Application Testing is the process of validating a web-based system to ensure it works correctly, securely, and efficiently across different browsers, devices, and network conditions.
A typical web application consists of:
- Frontend: HTML, CSS, JavaScript
- Backend: APIs, application servers
- Database
- Network & browser layer
Web testing ensures all layers work together without breaking business functionality, performance, or security.
2. Functional Testing Scenarios for Web Applications
Functional testing verifies what the application does against business requirements.
Login & Authentication Scenarios
- Valid username and password
- Invalid credentials error message
- Password masking
- Remember-me checkbox
- Account lock after multiple failed attempts
- Login using keyboard only (accessibility)
Session Management
- Session timeout after inactivity
- Logout invalidates session
- Back button after logout should not reopen session
- New session ID generated after re-login
Cookies & Storage
- Cookies created after login
- Cookie expiration validation
- Secure and HttpOnly flags
- Cookies cleared on logout
- LocalStorage vs SessionStorage behavior
Form Validation
- Mandatory field checks
- Input length limits
- Special character handling
- Server-side validation when JavaScript is disabled
Navigation & Links
- Broken links
- Page refresh during form submission
- Browser back/forward navigation
- URL manipulation handling
3. UI, UX, Responsive & Accessibility Test Cases
UI Testing
- Alignment of text, images, buttons
- Font consistency and size
- Color contrast
- Visibility of error messages
UX Testing
- Clear validation messages
- Logical navigation flow
- Minimal steps for key actions
- Meaningful labels and icons
Responsive Testing
- Desktop, tablet, and mobile views
- Orientation changes
- Touch vs mouse behavior
- Media query validation
Accessibility (A11y)
- Keyboard navigation
- Screen reader compatibility
- ARIA labels
- WCAG contrast compliance
4. Web Testing Interview Questions & Structured Answers
Q1. What are the layers involved in web application testing?
Answer:
Web testing covers:
- UI layer (browser rendering)
- Application logic layer
- API layer
- Database layer
- Network layer
Defects can occur at any layer, so testing must be end-to-end.
Q2. How is web testing different from desktop application testing?
Answer:
Web testing involves:
- Browser compatibility
- Client-server architecture
- Network dependency
- Security vulnerabilities
Desktop applications are mostly standalone and OS-specific.
Q3. How do you test login functionality in a web application?
Answer:
- Valid and invalid credentials
- SQL injection attempts in username/password
- Password masking
- Session creation and destruction
- Logout behavior
Login is a high-risk area and must be tested thoroughly.
Q4. How do you test session timeout?
Answer:
- Login and remain idle
- Verify automatic logout
- Perform action after timeout
- Validate session ID invalidation
Improper session handling leads to security vulnerabilities.
Q5. How do you test cookies?
Answer:
- Verify cookie creation
- Validate expiration time
- Check Secure and HttpOnly flags
- Delete cookies and refresh behavior
Cookies directly impact security and user sessions.
5. Security & Penetration Testing Interview Questions
Q6. What is Cross-Site Scripting (XSS)?
Answer:
XSS allows attackers to inject malicious JavaScript.
Example:
<script>alert(‘XSS’)</script>
Testing includes:
- Input fields
- URL parameters
- Stored vs reflected XSS
Q7. What is SQL Injection?
Answer:
SQL Injection manipulates backend queries.
Example:
‘ OR 1=1 —
Testing checks:
- Input sanitization
- Parameterized queries
- Error message exposure
Q8. What is CSRF?
Answer:
Cross-Site Request Forgery forces authenticated users to perform actions unknowingly.
Testing verifies:
- CSRF tokens
- SameSite cookie attributes
- Token validation per request
Q9. How do you test authentication abuse?
Answer:
- Brute-force login attempts
- Password reuse
- Role escalation
- Session fixation
Authentication issues are critical severity defects.
6. API & Web Services Validation Examples
Q10. Why is API testing important in web testing?
Answer:
Modern web apps rely heavily on APIs for:
- Login
- Data retrieval
- Transactions
UI testing alone cannot detect backend issues.
Q11. How do you test APIs using Postman?
Answer:
- Validate request and response
- Verify HTTP status codes (200, 201, 400, 401, 403, 500)
- Validate JSON schema
- Check headers and authentication tokens
Q12. Difference between JSON and XML?
Answer:
- JSON is lightweight and faster
- XML is verbose and schema-driven
Most modern web applications prefer JSON.
Q13. How do you validate API error responses?
Answer:
- Invalid payload
- Missing mandatory fields
- Unauthorized access
- Expired tokens
Error responses must be secure and meaningful.
7. Web Performance Testing Interview Questions
Q14. What is TTFB?
Answer:
Time To First Byte measures how quickly the server responds.
High TTFB indicates:
- Backend slowness
- Network latency
- Poor server configuration
Q15. What are key web performance metrics?
Answer:
- Page load time
- TTFB
- DOM load time
- API response time
- Resource load time
Q16. What is CDN and why is it used?
Answer:
Content Delivery Network serves static content from locations closer to users, reducing latency.
Testing ensures:
- Static assets load via CDN
- Cache headers are correctly configured
Q17. How do you test caching?
Answer:
- Validate cache-control headers
- Hard refresh vs soft refresh
- Stale data scenarios
Caching bugs can cause data inconsistency issues.
8. Browser & Device Compatibility Scenarios
Q18. What is cross-browser testing?
Answer:
Cross-browser testing ensures consistent behavior across:
- Chrome
- Firefox
- Edge
- Safari
Each browser has different rendering and JS engines.
Q19. How do you test mobile browsers?
Answer:
- Real devices
- Emulators
- Responsive viewports
Mobile users expect the same core functionality.
Q20. What issues commonly occur in browser compatibility?
Answer:
- CSS layout breaks
- JavaScript incompatibility
- Font and alignment issues
9. Real-Time Web Defects & RCA Examples
Defect Example 1: Session Not Expiring
- Issue: User remains logged in after inactivity
- Impact: Security risk
- Root Cause: Missing server-side validation
- Fix: Enforce backend session timeout
Defect Example 2: Broken UI in Safari
- Issue: Layout breaks in Safari
- Impact: Poor UX
- Root Cause: Unsupported CSS property
- Fix: Use cross-browser compatible CSS
10. Defect Logging Format + RCA
Sample Defect Template
- Defect ID
- Summary
- Environment
- Steps to Reproduce
- Expected Result
- Actual Result
- Screenshots / Network logs
- Severity & Priority
Severity vs Priority
- Severity: Impact on system
- Priority: Urgency of fix
11. Quick Revision Sheet (Interview Ready)
- Web testing = UI + API + DB + Security
- Login, sessions, cookies are high-risk
- Security testing is mandatory
- API testing reduces UI dependency
- Performance impacts user retention
- Cross-browser testing is essential
12. FAQs – Web Testing Interview Questions
Q: Is automation mandatory for web testing?
Not mandatory, but highly preferred.
Q: Should testers know HTML, CSS, and JavaScript?
Yes, basic knowledge helps identify root causes faster.
Q: What is the most critical area in web testing?
Authentication and session management.