1. What is Web Application Testing?
Web application testing is the process of validating a web-based system to ensure it works correctly, securely, efficiently, and consistently across browsers, devices, and user conditions. It covers functional behavior, UI/UX, performance, security, compatibility, and accessibility.
From a security perspective, web application testing ensures:
- Only authorized users access protected resources
- Data is validated, encrypted, and protected
- The application resists common attacks such as XSS, SQL Injection, CSRF, and authentication abuse
A complete web testing strategy blends manual testing, automation, API validation, and penetration testing.
2. Functional Testing Scenarios for Web Applications
Core Functional Scenarios
- User registration with valid/invalid inputs
- Login/logout functionality
- Password reset and OTP flows
- Form submission with mandatory/optional fields
- Navigation between pages
- Role-based access control
- Error message handling
Login & Authentication Test Scenarios
- Valid username/password login
- Invalid credentials error handling
- Account lock after multiple failed attempts
- Password masking
- CAPTCHA validation
- Session creation after login
- Logout invalidates session
Session Timeout Scenarios
- Session expires after inactivity
- User redirected to login after timeout
- Back button does not restore session
- Session timeout configurable from server
Cookies & Cache Scenarios
- Secure and HttpOnly flags enabled
- Cookies not accessible via JavaScript
- Sensitive data not cached in browser
- Cookie expiry matches session policy
3. UI + UX + Responsive + Accessibility Test Cases
UI Test Cases
- Proper alignment of UI elements
- Consistent fonts and colors
- Broken links detection
- Error messages clearly visible
UX Test Cases
- Minimal clicks to complete actions
- Clear navigation paths
- Helpful validation messages
- Predictable system behavior
Responsive Testing
- Layout adjusts on mobile/tablet/desktop
- No overlapping elements
- Touch-friendly buttons
- Media queries work correctly
Accessibility Testing (WCAG)
- Keyboard-only navigation
- Screen reader compatibility
- Alt text for images
- Proper contrast ratio
- ARIA labels used correctly
4. Web Application Security Testing Interview Questions and Answers
Q1. What is web application security testing?
Answer:
Web application security testing evaluates an application’s ability to protect data and functionality from unauthorized access, misuse, and attacks. It focuses on identifying vulnerabilities such as injection flaws, broken authentication, and insecure configurations.
Q2. Difference between functional testing and security testing?
Answer:
Functional testing validates what the application does, while security testing validates how safely it does it. A login feature may function correctly but still be vulnerable to brute-force attacks.
Q3. What is authentication vs authorization?
Answer:
- Authentication verifies user identity
- Authorization determines what actions the user can perform
A common defect is allowing unauthorized users to access admin URLs.
Q4. What is XSS?
Answer:
Cross-Site Scripting (XSS) allows attackers to inject malicious JavaScript into web pages viewed by other users.
Example:
<script>alert(‘Hacked’)</script>
If user input is not sanitized, this script executes in the victim’s browser.
Q5. Types of XSS?
Answer:
- Stored XSS
- Reflected XSS
- DOM-based XSS
Q6. How do you prevent XSS?
Answer:
- Input validation
- Output encoding
- Content Security Policy (CSP)
- HttpOnly cookies
Q7. What is SQL Injection?
Answer:
SQL Injection occurs when unvalidated input alters backend SQL queries.
Example:
SELECT * FROM users WHERE username=’admin’ OR ‘1’=’1′;
This can bypass authentication.
Q8. How do you test for SQL Injection?
Answer:
- Use special characters ‘ OR 1=1 —
- Observe error messages
- Validate prepared statements usage
Q9. What is CSRF?
Answer:
Cross-Site Request Forgery tricks authenticated users into performing unwanted actions.
Q10. How to prevent CSRF?
Answer:
- CSRF tokens
- SameSite cookies
- Referer validation
Q11. What is broken authentication?
Answer:
When authentication mechanisms allow attackers to compromise credentials, sessions, or tokens.
Q12. What is session fixation?
Answer:
An attacker forces a user to use a known session ID, then hijacks it after login.
Q13. What headers improve security?
Answer:
- X-Frame-Options
- Content-Security-Policy
- X-Content-Type-Options
- Strict-Transport-Security
Q14. How do you test authorization?
Answer:
- Access URLs with lower-privileged roles
- Modify user IDs in requests
- Attempt horizontal/vertical privilege escalation
Q15. What is clickjacking?
Answer:
Tricking users into clicking hidden elements via iframes.
5. Security & Penetration-Based Questions
Q16. What is penetration testing?
Answer:
Simulated cyberattack to evaluate system defenses.
Q17. Difference between vulnerability scanning and penetration testing?
Answer:
Scanning identifies known vulnerabilities; penetration testing exploits them.
Q18. What is OWASP Top 10?
Answer:
A list of top web application security risks including injection, broken auth, and XSS.
Q19. What is authentication abuse?
Answer:
Misuse of login features such as credential stuffing or brute force attacks.
Q20. How do you test brute force protection?
Answer:
- Multiple login attempts
- Check lockout or CAPTCHA enforcement
- Verify rate limiting
6. API + Web Services Validation Examples
API Testing Scenarios
- Validate request/response schema
- Verify HTTP status codes
- Test authorization tokens
- Validate error handling
Common HTTP Status Codes
- 200 OK
- 201 Created
- 400 Bad Request
- 401 Unauthorized
- 403 Forbidden
- 500 Internal Server Error
Postman Example (Login API)
POST /api/login
{
“username”: “testuser”,
“password”: “password123”
}
SOAPUI Use Case
- Validate XML schema
- SOAP fault handling
- WSDL verification
7. Web Performance Checkpoints
Performance Metrics
- TTFB (Time to First Byte)
- Page load time
- API response time
- Concurrent users supported
Caching & CDN
- Browser cache headers
- Server-side caching
- CDN usage for static assets
8. Browser & Device Compatibility Scenarios
- Chrome, Firefox, Edge, Safari
- Android vs iOS rendering
- Different screen resolutions
- JavaScript compatibility issues
9. Real-Time Defect + RCA Examples
Defect Example 1
Issue: Session remains active after logout
Impact: Security vulnerability
Root Cause: Session token not invalidated server-side
Fix: Destroy session on logout API
Defect Example 2
Issue: XSS vulnerability in comments section
Root Cause: Missing output encoding
Fix: HTML encode user inputs
10. Defect Logging Format + RCA
Defect Template
- Defect ID
- Summary
- Steps to Reproduce
- Expected Result
- Actual Result
- Severity
- Priority
- Root Cause
- Environment
Severity vs Priority
- Severity: Impact on system
- Priority: Fix urgency
11. Quick Revision Sheet
- Validate inputs
- Secure sessions
- Test authorization
- Check headers
- Verify API security
- Monitor performance
- Test across browsers
12. FAQs + CTA
FAQ 1: Is web security testing manual or automated?
Both. Manual for logic flaws, automation for regression and scanning.
FAQ 2: Do testers need coding?
Basic HTML, JavaScript, SQL knowledge is essential.