1. What Is Web Application Testing?
Web Application Testing is the process of validating a web-based system to ensure it is:
- Functionally correct
- Secure from attacks
- Performant under load
- Compatible across browsers and devices
- Usable and accessible for end users
A web application typically consists of:
- Frontend (HTML, CSS, JavaScript)
- Backend services (APIs, servers)
- Database
- Network and browser layers
Testing ensures all these layers work together correctly.
2. Functional Testing Scenarios for Web Applications
Functional testing validates what the application does.
Common Web Functional Scenarios
Login & Authentication
- Valid username/password
- Invalid credentials error message
- Password masking
- Remember-me functionality
- Account lock after failed attempts
Session Management
- Session timeout after inactivity
- Logout invalidates session
- New login creates new session ID
- Multiple browser sessions behavior
Cookies & Storage
- Cookies created after login
- Secure & HttpOnly flags enabled
- Cookies cleared on logout
- LocalStorage vs SessionStorage usage
Form Validation
- Mandatory field validation
- Input length limits
- Special characters handling
- Server-side validation even if JS is bypassed
Navigation
- Broken links
- Browser back/forward behavior
- Refresh handling during form submission
3. UI, UX, Responsive & Accessibility Testing
UI Testing
- Alignment of text, buttons, images
- Font consistency
- Color contrast
- Error message visibility
UX Testing
- Clear error messages
- Logical navigation
- Fewer clicks for critical flows
- User-friendly labels
Responsive Testing
- Mobile, tablet, desktop views
- Orientation change (portrait/landscape)
- Touch vs mouse behavior
- Media queries validation
Accessibility (A11y)
- Keyboard navigation
- Screen reader support
- ARIA labels
- Contrast ratio compliance (WCAG)
4. Web Application Testing Interview Questions & Answers
Q1. What are the layers involved in web application testing?
Answer:
Web testing covers:
- UI layer (browser rendering)
- Application logic layer
- API layer
- Database layer
- Network layer
Defects can occur at any layer, so testing must be end-to-end.
Q2. What is the difference between web testing and desktop testing?
Answer:
Web testing includes:
- Browser compatibility
- Network dependency
- Client-server architecture
- Security vulnerabilities
Desktop testing is mostly standalone and environment-specific.
Q3. How do you test login functionality?
Answer:
- Valid/invalid credentials
- SQL injection attempt in username
- Password masking
- Session creation
- Logout behavior
Login is a high-risk entry point, so testing must be deep.
Q4. How do you test session timeout?
Answer:
- Login → stay idle → check auto logout
- Perform action after timeout
- Verify session ID invalidation
Incorrect session handling can lead to security issues.
Q5. How do you test cookies?
Answer:
- Verify cookie creation
- Check expiration
- Validate Secure and HttpOnly flags
- Delete cookies and refresh behavior
Cookies directly impact security and session management.
5. Security & Penetration Testing Interview Questions
Q6. What is XSS?
Answer:
Cross-Site Scripting allows attackers to inject malicious JavaScript.
Example:
<script>alert(‘XSS’)</script>
Testing includes:
- Input fields
- URL parameters
- Stored vs reflected XSS
Q7. What is SQL Injection?
Answer:
SQL Injection manipulates database queries.
Example:
‘ OR 1=1 —
Testing verifies:
- Parameterized queries
- Input sanitization
- Error message handling
Q8. What is CSRF?
Answer:
Cross-Site Request Forgery forces users to perform actions unknowingly.
Testing checks:
- CSRF tokens
- SameSite cookie attributes
- Token validation per request
Q9. How do you test authentication abuse?
Answer:
- Brute force attempts
- Password reuse
- Session fixation
- Role escalation attempts
Authentication flaws are critical severity.
6. API & Web Services Validation (Web Context)
Q10. How do APIs fit into web testing?
Answer:
Modern web apps depend on APIs for:
- Login
- Data fetch
- Transactions
UI testing alone is insufficient.
Q11. How do you test APIs using Postman?
Answer:
- Validate request/response
- Check status codes (200, 400, 401, 500)
- Verify JSON schema
- Validate headers
Q12. Difference between JSON and XML?
Answer:
- JSON is lightweight and faster
- XML is verbose and schema-driven
Most modern web apps use JSON.
Q13. How do you validate API errors?
Answer:
- Incorrect payload
- Missing fields
- Unauthorized access
- Invalid tokens
Error responses must be clear and secure.
7. Web Performance Testing Interview Questions
Q14. What is TTFB?
Answer:
Time To First Byte measures server responsiveness.
High TTFB indicates:
- Server slowness
- Network latency
- Backend issues
Q15. What are key web performance metrics?
Answer:
- Page load time
- TTFB
- DOM load
- Resource load
- API response time
Q16. What is CDN?
Answer:
Content Delivery Network reduces latency by serving content closer to users.
Testing ensures:
- Static resources load via CDN
- Cache headers are set correctly
Q17. How do you test caching?
Answer:
- Validate cache-control headers
- Hard refresh vs soft refresh
- Stale data scenarios
Incorrect caching causes data inconsistency bugs.
8. Browser & Device Compatibility Scenarios
Q18. What browsers do you test?
Answer:
- Chrome
- Firefox
- Edge
- Safari
Priority depends on user analytics.
Q19. What is cross-browser testing?
Answer:
Testing ensures UI and functionality behave consistently across browsers.
Issues arise due to:
- Different JS engines
- CSS rendering differences
Q20. How do you test mobile browsers?
Answer:
- Real devices
- Emulators
- Viewport testing
Mobile users expect the same core functionality.
9. Real-Time Web Defects & RCA Examples
Defect Example 1: Session Not Expiring
- Issue: User remains logged in after 30 minutes idle
- Impact: Security risk
- Root Cause: Missing server-side session validation
- Fix: Enforce timeout on backend
Defect Example 2: Broken Layout in Safari
- Issue: CSS grid breaks in Safari
- Impact: Poor UX
- Root Cause: Unsupported CSS property
- Fix: Cross-browser compatible CSS
10. Defect Logging Format (Web Apps)
Sample Defect Template
- Title
- Environment
- Steps to Reproduce
- Expected Result
- Actual Result
- Screenshots / Network logs
- Severity & Priority
Severity vs Priority
- Severity: Impact on system
- Priority: Urgency of fix
11. Quick Revision Sheet (Interview Ready)
- Web testing = UI + API + DB + Security
- Login, session, cookies are high-risk
- Security testing is mandatory
- API testing reduces UI dependency
- Performance impacts user retention
- Browser compatibility cannot be ignored
12. FAQs – Web Application Testing Interview Questions
Q: Is automation mandatory for web testing?
Not mandatory, but highly preferred.
Q: Should testers know HTML/CSS/JS?
Yes, basic understanding helps debug issues faster.
Q: What is the most critical area in web testing?
Authentication and session management.