1. What is Web Application Testing?
Web application testing is the process of validating a web-based system to ensure it is functionally correct, secure, performant, usable, and compatible across browsers, devices, and environments.
For experienced testers, web application testing goes beyond checking UI flows. It involves:
- Risk-based test design
- Deep validation of sessions, cookies, APIs, caching, and security
- Understanding architecture, logs, and production issues
- Performing root cause analysis (RCA) and quality improvements
A senior tester focuses on preventing defects, not just detecting them.
2. Functional Testing Scenarios for Web Applications
Core Functional Scenarios
- User registration with valid and invalid inputs
- Login/logout functionality
- Password reset and account recovery
- Form validation (client-side & server-side)
- Role-based access control
- Error handling and graceful failures
- Data persistence across sessions
Login & Authentication Test Scenarios
- Login with valid credentials
- Invalid username/password error message validation
- Password masking and encryption
- Account lock after multiple failed attempts
- CAPTCHA triggering after failures
- Login using copied URL without authentication
- Concurrent logins from different devices
Session Timeout Scenarios
- Session expires after inactivity
- User redirected to login page after timeout
- Browser back button does not restore session
- Session ID regenerated after login
- Session invalidated on logout
Cookies & Cache Scenarios
- Cookies have Secure and HttpOnly flags
- Sensitive data not stored in cookies
- Cookie expiry aligns with session timeout
- No caching of sensitive pages
- Browser cache cleared after logout
3. UI + UX + Responsive + Accessibility Test Cases
UI Test Cases
- UI consistency across pages
- Alignment and spacing
- Font, color, and branding consistency
- Broken images and links
- Proper display of error messages
UX Test Cases
- Logical navigation flow
- Minimal steps to complete tasks
- Clear and actionable validation messages
- Consistent behavior across flows
- Predictable system responses
Responsive Testing
- Layout adjusts correctly on mobile, tablet, and desktop
- No overlapping elements on small screens
- Responsive menus and touch-friendly buttons
- Orientation change handling
Accessibility Testing (WCAG)
- Keyboard-only navigation
- Screen reader compatibility
- Proper alt text for images
- Color contrast ratio compliance
- ARIA labels for dynamic content
4. Web Application Testing Interview Questions for Experienced (with Answers)
Q1. What types of testing are essential for web applications?
Answer:
Functional, UI/UX, API, security, performance, compatibility, accessibility, and regression testing are all essential. Experienced testers prioritize them based on business risk.
Q2. How is web testing different from desktop application testing?
Answer:
Web testing includes browser compatibility, stateless HTTP behavior, session handling, security vulnerabilities, and client-server interactions, which are minimal in desktop apps.
Q3. What is statelessness in web applications?
Answer:
HTTP is stateless, meaning each request is independent. Sessions and cookies are used to maintain user state.
Q4. How do you test session management?
Answer:
By validating session creation, expiration, regeneration, invalidation, and resistance to fixation or hijacking.
Q5. What is the difference between cookies and sessions?
Answer:
Cookies store data on the client; sessions store data on the server and use cookies or tokens as identifiers.
Q6. How do you test browser caching issues?
Answer:
Check cache headers, refresh behavior, back button handling, and sensitive page visibility after logout.
Q7. What is cross-browser testing?
Answer:
Testing application behavior across different browsers, versions, and rendering engines.
Q8. How do you prioritize test cases in tight timelines?
Answer:
By focusing on business-critical flows, high-risk modules, recent changes, and historical defect-prone areas.
Q9. What is boundary value analysis in web forms?
Answer:
Testing inputs at minimum, maximum, and just beyond allowed limits to uncover validation issues.
Q10. How do you test file uploads?
Answer:
Validate file size, type, malicious content, upload interruptions, and server-side validation.
Q11. What is client-side vs server-side validation?
Answer:
Client-side improves UX; server-side ensures security. Both must be tested.
Q12. What common UI defects do you see in production?
Answer:
Broken layouts, overlapping elements, unreadable text on mobile, missing error messages.
Q13. How do you validate error handling?
Answer:
Trigger invalid actions and verify meaningful, non-technical, and secure error messages.
Q14. What is deep link testing?
Answer:
Testing access to internal URLs directly without proper authentication.
Q15. How do you test pagination?
Answer:
Verify page navigation, record count consistency, sorting, filtering, and performance.
5. Security & Penetration-Based Interview Questions
Q16. What is XSS?
Answer:
Cross-Site Scripting allows attackers to inject malicious JavaScript into web pages.
Example:
<script>alert(‘XSS’)</script>
Q17. How do you test for XSS?
Answer:
Inject scripts into inputs and verify if they execute or are safely encoded.
Q18. What is SQL Injection?
Answer:
An attack where malicious SQL queries manipulate backend databases.
Example:
‘ OR ‘1’=’1
Q19. How do you prevent SQL Injection?
Answer:
Prepared statements, parameterized queries, and input validation.
Q20. What is CSRF?
Answer:
An attack that forces authenticated users to perform unintended actions.
Q21. How do you test CSRF protection?
Answer:
Remove or modify CSRF tokens and verify request rejection.
Q22. What is authentication abuse?
Answer:
Misuse of authentication features like brute force or credential stuffing.
Q23. How do you test brute force protection?
Answer:
Attempt repeated logins and verify lockout, CAPTCHA, or rate limiting.
Q24. What is session fixation?
Answer:
Forcing a known session ID on a user and hijacking it post-login.
Q25. What security headers should be tested?
Answer:
CSP, HSTS, X-Frame-Options, X-Content-Type-Options.
6. API + Web Services Validation Examples
API Testing Scenarios
- Validate request/response schema
- Authorization token validation
- Error handling
- Boundary values
Common HTTP Status Codes
- 200 OK
- 201 Created
- 400 Bad Request
- 401 Unauthorized
- 403 Forbidden
- 500 Internal Server Error
Sample JSON Request
{
“username”: “testuser”,
“password”: “Pass@123”
}
XML (SOAP) Example
<loginRequest>
<username>testuser</username>
<password>Pass@123</password>
</loginRequest>
Postman / SOAPUI Usage
- Validate headers
- Assert response time
- Validate schema
- Automate regression APIs
7. Web Performance Checkpoints
Key Performance Metrics
- TTFB (Time to First Byte)
- Page load time
- API response time
- Concurrent user handling
CDN & Caching
- Static content served via CDN
- Browser cache headers validated
- Server-side caching efficiency
8. Browser & Device Compatibility Scenarios
- Chrome, Firefox, Edge, Safari
- Android vs iOS rendering
- Different screen resolutions
- JavaScript compatibility issues
9. Real-Time Defects with RCA
Defect 1: Session Active After Logout
- Impact: Security risk
- Root Cause: Session token not invalidated server-side
- Fix: Destroy session on logout API
Defect 2: XSS in Comment Section
- Root Cause: Missing output encoding
- Fix: HTML encode user inputs
Defect 3: Slow Page Load
- Root Cause: Large uncompressed images
- Fix: Enable compression and CDN caching
10. Defect Logging Format + RCA
Defect Template
- Defect ID
- Summary
- Steps to Reproduce
- Expected Result
- Actual Result
- Severity
- Priority
- Root Cause
- Environment
Severity vs Priority
- Severity: Impact on system
- Priority: Urgency of fix
11. Quick Revision Sheet
- Validate authentication & sessions
- Test authorization thoroughly
- Secure inputs & outputs
- Validate APIs independently
- Monitor performance metrics
- Test across browsers and devices
- Perform RCA on major defects
12. FAQs + CTA
FAQ 1: What level of security knowledge is expected from experienced testers?
Basic understanding of OWASP Top 10 and common attack vectors is expected.
FAQ 2: Is automation mandatory for experienced testers?
Not mandatory, but understanding automation and CI pipelines is a strong advantage.