1. What is Web Application Testing?
Web application testing is the process of validating a web-based system to ensure it is functional, secure, performant, usable, and compatible across browsers, devices, and environments.
When the focus is web security testing, the objective shifts to:
- Protecting data confidentiality, integrity, and availability
- Preventing unauthorized access
- Identifying vulnerabilities such as XSS, SQL Injection, CSRF, and authentication abuse
- Ensuring sessions, cookies, APIs, and caching are secure
Security testing is not a one-time activity—it must be integrated throughout the SDLC.
2. Functional Testing Scenarios for Web Applications (Security-Oriented)
Even functional areas can expose security risks if not tested correctly.
Login & Authentication Scenarios
- Valid and invalid credential handling
- Error messages do not reveal sensitive information
- Password masking and encryption
- Account lock after multiple failed attempts
- CAPTCHA or rate limiting enforcement
- Login via bookmarked or deep links
- Concurrent login sessions handling
Session Timeout Scenarios
- Session expires after configured idle time
- Session invalidated on logout
- Back button does not restore session
- Session ID regenerated after login
- Multiple tabs behavior after logout
Cookies & Cache Scenarios
- Cookies contain no sensitive data
- Secure and HttpOnly flags enabled
- SameSite attribute validated
- Cookie expiry aligned with session timeout
- Sensitive pages not cached
- Browser refresh does not expose secured data
API Call Scenarios
- API access requires valid authentication
- Authorization enforced at API level
- Invalid tokens rejected
- Sensitive data not exposed in responses
- Error handling does not reveal stack traces
3. UI + UX + Responsive + Accessibility Test Cases (Security Impact)
UI Security Test Cases
- Error messages are generic and non-technical
- No sensitive data displayed in UI
- Hidden fields do not expose critical values
- Disable autocomplete for sensitive fields
UX with Security Perspective
- Clear password rules
- Secure but usable flows
- Confirmation prompts for critical actions
- Clear logout visibility
Responsive & Accessibility Security Checks
- Same security behavior on mobile and desktop
- Secure keyboard navigation
- Screen readers do not read hidden sensitive data
- Responsive layouts do not expose hidden elements
4. Web Security Testing Interview Questions & Answers
Q1. What is web security testing?
Answer:
Web security testing evaluates a web application’s ability to protect data and functionality from unauthorized access, misuse, and attacks by identifying vulnerabilities in authentication, authorization, sessions, inputs, and APIs.
Q2. Difference between functional testing and security testing?
Answer:
Functional testing checks what the system does, while security testing checks how safely it does it. A feature can work correctly but still be insecure.
Q3. What are the core principles of web security?
Answer:
Confidentiality, Integrity, and Availability (CIA triad).
Q4. What is authentication vs authorization?
Answer:
Authentication verifies identity, while authorization controls access levels.
Q5. What is statelessness in web applications?
Answer:
HTTP is stateless; sessions and tokens are used to maintain user context.
Q6. How do you test session management?
Answer:
Validate session creation, expiration, regeneration, invalidation, and resistance to fixation and hijacking.
Q7. What is broken authentication?
Answer:
When flaws allow attackers to compromise credentials, sessions, or tokens.
Q8. How do you test authorization?
Answer:
By accessing restricted URLs, modifying user IDs, and attempting privilege escalation.
Q9. What is deep link testing?
Answer:
Accessing internal URLs directly without authentication.
Q10. What is input validation?
Answer:
Ensuring only expected data is accepted and processed.
5. Security & Penetration-Based Interview Questions
Q11. What is XSS?
Answer:
Cross-Site Scripting allows attackers to inject malicious JavaScript into web pages.
HTML Example:
<script>alert(‘XSS’)</script>
Q12. Types of XSS?
Answer:
- Stored
- Reflected
- DOM-based
Q13. How do you prevent XSS?
Answer:
Output encoding, input validation, Content Security Policy, HttpOnly cookies.
Q14. What is SQL Injection?
Answer:
Manipulating backend SQL queries through malicious input.
Example:
‘ OR ‘1’=’1
Q15. How do you test SQL Injection?
Answer:
Inject SQL characters and observe error messages or data exposure.
Q16. How do you prevent SQL Injection?
Answer:
Parameterized queries, prepared statements, input validation.
Q17. What is CSRF?
Answer:
Cross-Site Request Forgery tricks authenticated users into performing unwanted actions.
Q18. How do you test CSRF protection?
Answer:
Remove or modify CSRF tokens and verify request rejection.
Q19. What is authentication abuse?
Answer:
Misuse of login mechanisms such as brute force or credential stuffing.
Q20. How do you test brute force protection?
Answer:
Attempt multiple failed logins and verify CAPTCHA, lockout, or rate limiting.
Q21. What is session fixation?
Answer:
Forcing a known session ID on a user and hijacking it after login.
Q22. What is clickjacking?
Answer:
Tricking users into clicking hidden elements using iframes.
Q23. What security headers should be validated?
Answer:
- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
- Strict-Transport-Security
6. API + Web Services Validation Examples
API Security Test Scenarios
- Authentication token validation
- Authorization at API level
- Input validation for JSON/XML
- Error handling and status codes
- Rate limiting validation
Common HTTP Status Codes
- 200 OK
- 201 Created
- 400 Bad Request
- 401 Unauthorized
- 403 Forbidden
- 404 Not Found
- 500 Internal Server Error
Sample JSON Request
{
“username”: “securityUser”,
“password”: “Secure@123”
}
Sample XML Request
<loginRequest>
<username>securityUser</username>
<password>Secure@123</password>
</loginRequest>
Postman / SOAPUI Usage
- Send authenticated requests
- Validate headers and tokens
- Assert response schema
- Measure response time
- Validate negative scenarios
7. Web Performance Checkpoints (Security Angle)
Performance Metrics
- TTFB (Time to First Byte)
- Page load time
- API response time
- Concurrent user handling
CDN & Caching Security Checks
- Static resources cached via CDN
- Sensitive pages not cached
- Cache-control headers validated
- Compression enabled without exposing data
8. Browser & Device Compatibility Scenarios
- Same security behavior across browsers
- No browser-specific vulnerabilities
- Mobile and desktop parity
- JavaScript execution consistency
9. Real-Time Defects with RCA
Defect 1: Session Active After Logout
- Severity: Critical
- Priority: High
- Root Cause: Server-side session not invalidated
- Fix: Destroy session token on logout
Defect 2: Stored XSS in Comment Field
- Root Cause: Missing output encoding
- Fix: Encode user input before rendering
Defect 3: Sensitive Data Cached
- Root Cause: Incorrect cache-control headers
- Fix: Disable caching for secured pages
10. Defect Logging Format + RCA
Defect Template
- Defect ID
- Summary
- Steps to Reproduce
- Expected Result
- Actual Result
- Severity
- Priority
- Root Cause
- Environment
Severity vs Priority
- Severity: Impact on system security
- Priority: Urgency of fix
11. Quick Revision Sheet
- Validate authentication & authorization
- Secure sessions and cookies
- Test input/output handling
- Validate API security
- Check headers and caching
- Monitor performance metrics
- Perform RCA for critical issues
12. FAQs + CTA
FAQ 1: Is web security testing only for security teams?
No. Testers must perform basic security testing as part of QA.
FAQ 2: Do manual testers need penetration testing skills?
Basic knowledge of common attacks is expected; deep pentesting is a specialization.