1. What Is Web Application Testing?
Web Application Testing is the process of verifying a web-based application to ensure it works correctly, securely, and efficiently across browsers, devices, and network conditions.
A typical web application consists of:
- Frontend – HTML, CSS, JavaScript (UI & UX)
- Backend – Application server and APIs
- Database – Data storage and retrieval
- Network & Browser layer
Web app testing ensures all these layers interact correctly without breaking business functionality, performance, or security.
2. Functional Testing Scenarios for Web Apps
Functional testing validates what the web app does based on requirements.
Login & Authentication Scenarios
- Valid username and password
- Invalid credentials error message
- Password masking
- Remember-me checkbox behavior
- Account lock after multiple failed attempts
- Login using keyboard only (accessibility check)
Session Management Scenarios
- Session timeout after inactivity
- Logout invalidates the session
- Back button should not restore session after logout
- New session ID generated after re-login
Cookies & Storage
- Cookies created after successful login
- Cookie expiration validation
- Secure and HttpOnly flags enabled
- Cookies cleared on logout
- LocalStorage vs SessionStorage behavior
Form Validation
- Mandatory field validation
- Input length limits
- Special character handling
- Server-side validation even if JavaScript is disabled
Navigation & URL Handling
- Broken links
- Page refresh during form submission
- Browser back/forward navigation
- URL manipulation and deep-link handling
3. UI, UX, Responsive & Accessibility Test Cases
UI Testing
- Alignment of text, buttons, and images
- Font size and style consistency
- Color contrast and visibility
- Error message placement and readability
UX Testing
- Clear validation and error messages
- Logical navigation flow
- Minimal steps for critical actions (login, checkout)
- Meaningful labels and icons
Responsive Testing
- Desktop, tablet, and mobile views
- Orientation change (portrait/landscape)
- Touch vs mouse interactions
- Media query behavior
Accessibility (A11y)
- Keyboard navigation (Tab, Enter, Esc)
- Screen reader compatibility
- ARIA labels for form elements
- WCAG color contrast compliance
4. Web App Testing Interview Questions & Structured Answers
Q1. What layers are involved in web app testing?
Answer:
Web app testing covers:
- UI layer (browser rendering)
- Application/business logic layer
- API layer
- Database layer
- Network layer
Defects can occur at any layer, so testing must be end-to-end.
Q2. How is web app testing different from desktop application testing?
Answer:
Web app testing involves:
- Browser compatibility
- Client-server communication
- Network dependency
- Security vulnerabilities
Desktop applications are mostly standalone and OS-specific.
Q3. How do you test login functionality in a web app?
Answer:
- Valid and invalid credentials
- SQL injection attempts in username/password
- Password masking
- Session creation
- Logout behavior
Login is a high-risk area, so both functional and security testing are required.
Q4. How do you test session timeout?
Answer:
- Login and remain idle
- Verify auto logout after configured time
- Perform action after timeout
- Validate session ID invalidation
Improper session handling leads to security vulnerabilities.
Q5. How do you test cookies in a web app?
Answer:
- Verify cookie creation after login
- Validate expiration time
- Check Secure and HttpOnly flags
- Delete cookies and refresh the page
Cookies directly impact security and session management.
Q6. How do you test caching behavior?
Answer:
- Validate Cache-Control headers
- Hard refresh vs soft refresh
- Verify stale data scenarios
Caching bugs often cause data inconsistency issues.
5. Security & Penetration Testing Interview Questions
Q7. What is Cross-Site Scripting (XSS)?
Answer:
XSS allows attackers to inject malicious JavaScript into web pages.
Example:
<script>alert(‘XSS’)</script>
Testing includes:
- Input fields
- URL parameters
- Stored and reflected XSS scenarios
Q8. What is SQL Injection?
Answer:
SQL Injection manipulates backend database queries.
Example:
‘ OR 1=1 —
Testing checks:
- Input sanitization
- Parameterized queries
- Error message exposure
Q9. What is CSRF?
Answer:
Cross-Site Request Forgery forces authenticated users to perform actions unknowingly.
Testing verifies:
- CSRF tokens
- SameSite cookie attributes
- Token validation per request
Q10. How do you test authentication abuse?
Answer:
- Brute-force login attempts
- Password reuse scenarios
- Role escalation attempts
- Session fixation testing
Authentication flaws are critical severity defects.
6. API & Web Services Validation Examples
Q11. Why is API testing important in web app testing?
Answer:
Modern web apps rely heavily on APIs for:
- Authentication
- Data retrieval
- Transactions
UI testing alone cannot detect backend data or logic issues.
Q12. How do you test APIs using Postman?
Answer:
- Validate request and response payloads
- Verify HTTP status codes (200, 201, 400, 401, 403, 500)
- Validate JSON schema
- Check headers and authentication tokens
Q13. Difference between JSON and XML?
Answer:
- JSON is lightweight, faster, and easier to parse
- XML is verbose and schema-driven
Most modern web apps prefer JSON.
Q14. How do you validate API error responses?
Answer:
- Invalid payload
- Missing mandatory fields
- Unauthorized access
- Expired tokens
Error responses must be secure, consistent, and meaningful.
7. Web Performance Testing Interview Questions
Q15. What is TTFB?
Answer:
Time To First Byte measures how quickly the server sends the first byte of response.
High TTFB indicates:
- Backend slowness
- Network latency
- Poor server configuration
Q16. What are key web performance metrics?
Answer:
- Page load time
- TTFB
- DOM load time
- API response time
- Resource load time
Q17. What is CDN and why is it used?
Answer:
A Content Delivery Network serves static assets from locations closer to users, reducing latency.
Testing ensures:
- Static resources load via CDN
- Cache headers are configured correctly
Q18. How do you test load time issues?
Answer:
- Use browser dev tools
- Analyze network waterfall
- Check API response times
- Identify heavy resources
Performance directly impacts user retention.
8. Browser & Device Compatibility Scenarios
Q19. What is cross-browser testing?
Answer:
Cross-browser testing ensures consistent behavior across:
- Chrome
- Firefox
- Edge
- Safari
Each browser has different rendering and JavaScript engines.
Q20. How do you test mobile web applications?
Answer:
- Real devices
- Emulators/simulators
- Responsive viewports
Mobile users expect the same core functionality as desktop users.
Q21. What are common browser compatibility issues?
Answer:
- CSS layout breaks
- JavaScript incompatibility
- Font and alignment issues
9. Real-Time Web App Defects & RCA Examples
Defect Example 1: Session Not Expiring
- Issue: User remains logged in after inactivity
- Impact: Security risk
- Root Cause: Missing server-side session validation
- Fix: Enforce backend session timeout
Defect Example 2: UI Breaks in Safari
- Issue: Layout breaks only in Safari browser
- Impact: Poor user experience
- Root Cause: Unsupported CSS property
- Fix: Use cross-browser compatible CSS
Defect Example 3: API Returns 500 Error
- Issue: API fails for large payload
- Impact: Data not displayed in UI
- Root Cause: Backend validation missing
- Fix: Add payload validation and error handling
10. Defect Logging Format + RCA + Priority/Severity
Sample Defect Template
- Defect ID
- Summary
- Environment
- Steps to Reproduce
- Expected Result
- Actual Result
- Screenshots / Logs
- Severity & Priority
Severity vs Priority
- Severity: Impact on application
- Priority: Urgency of fixing the defect
11. Quick Revision Sheet (Interview-Ready)
- Web app testing = UI + API + DB + Security
- Login, sessions, cookies are high-risk areas
- Security testing is mandatory
- API testing reduces dependency on UI
- Performance affects business metrics
- Cross-browser testing is critical
12. FAQs – Web App Testing Interview Questions
Q: Is automation mandatory for web app testing?
Not mandatory, but highly preferred.
Q: Should testers know HTML, CSS, and JavaScript?
Yes. Basic knowledge helps in faster defect analysis and RCA.
Q: What is the most critical area in web app testing?
Authentication, session management, and security.