optional · CSS study notes
24. Web Application Issues — Testing
CSS Optional — Paper-II, Section-B · P-II.VI.24 · Web testing is harder than traditional testing because of browsers, devices, networks, scale and exposure. Links to V&V on the RE Process page.
1. Why Testing Web Applications Is Special
- Many browser/OS/device/screen combinations.
- Unpredictable load and concurrent users.
- Network variability (4G, slow Wi-Fi, packet loss).
- Security exposure to the whole internet.
- Rapid releases → need automated regression testing.
- Content and usability are quality factors in their own right.
- Multi-tier systems: failures can be in the browser, server, database or integrations.
2. Testing Levels
| Level | Tests | Web example |
|---|---|---|
| Unit | Individual functions/classes | PHP function computing fee (PHPUnit), JS validator (Jest) |
| Integration | Interaction between modules/services | Controller + database; payment API integration |
| System | Whole application against requirements | End-to-end admission flow in a browser |
| Acceptance (UAT) | Client/users confirm it meets needs | Registrar's office approves the portal |
Test pyramid: many fast unit tests, fewer integration tests, few slow end-to-end UI tests.
3. Types of Web Testing
| Type | Checks | Tools |
|---|---|---|
| Functional | Features work per requirements (forms, links, workflows) | Selenium, Cypress, Playwright |
| Usability | Ease of use, navigation, clarity | User testing, heatmaps (Hotjar) |
| UI / visual | Layout, fonts, responsiveness | Visual regression tools |
| Compatibility (cross-browser/device) | Works on Chrome, Firefox, Safari, Edge; phones/tablets | BrowserStack, device labs |
| Performance (load, stress, spike, endurance) | Response time and stability under load | JMeter, k6, Gatling |
| Security | Vulnerabilities: injection, XSS, CSRF, auth flaws | OWASP ZAP, Burp Suite; penetration testing |
| Accessibility | WCAG compliance | WAVE, axe, screen readers |
| Link and content | Broken links, spelling, outdated content | Link checkers |
| Database | Data integrity, transactions | SQL checks, test fixtures |
| API | Endpoints, status codes, payloads | Postman |
| Regression and smoke | Old features still work; quick check that the build is stable | Automated suites in CI |
Performance test types: load (expected users), stress (beyond capacity to find the breaking point), spike (sudden surge), endurance/soak (long duration — memory leaks), scalability (adding resources).
4. Techniques
- Black-box: test inputs/outputs without seeing code — equivalence partitioning, boundary value analysis, decision tables.
- White-box: test internal paths — statement/branch coverage.
- Manual vs automated: automate regression and repetitive checks; keep manual exploratory and usability testing.
5. Example Test Cases — Login
| ID | Input | Expected result |
|---|---|---|
| TC-01 | Valid email + correct password | Redirect to dashboard |
| TC-02 | Valid email + wrong password | "Invalid credentials"; no hint which part is wrong |
| TC-03 | Empty fields | Validation messages shown |
| TC-04 | 5 wrong attempts | Account locked 15 minutes |
| TC-05 | Email: ' OR '1'='1 | Login rejected (no SQL injection) |
| TC-06 | Password with 7 characters on registration (min 8) | Rejected — boundary value |
Boundary value analysis numerical: a password must be 8–16 characters. Test lengths 7, 8, 9, 15, 16, 17 (just below, on and just above each boundary).
🎯 CSS Exam Angle
Start with why web testing is harder, then levels and a types table with tools, then a small test-case table. Linking testing back to requirements (traceability) and V&V earns extra credit.
⚠️ MCQ Traps
- Load testing = expected load; stress testing = beyond capacity.
- Regression testing re-checks old features after changes; smoke testing is a quick build sanity check.
- Black-box = no code knowledge; white-box = code-based.
- UAT is performed by the client/users, not only the developers.
- Selenium automates browser testing; JMeter is for performance.
✅ Self-Check (with Answers)
Q1. Give four reasons web testing is more complex than desktop testing.
Ans: Many browser/device combinations; unpredictable concurrent load; network variability; exposure to internet-wide security attacks; frequent releases needing regression tests.
Q2. Differentiate load, stress and spike testing.
Ans: Load — behaviour under expected user numbers; stress — push beyond capacity to find the breaking point and recovery; spike — sudden, sharp increases in traffic (e.g. result announcement).
Q3. An age field accepts 18–60. Which values would boundary value analysis test?
Ans: 17, 18, 19, 59, 60, 61.
Q4. What is regression testing and why is automation important for it?
Ans: Re-running tests after changes to ensure existing features still work. Web apps change frequently, so automated regression suites in CI catch breakages quickly and cheaply.
Q5. Name one tool each for functional, performance, security and API testing.
Ans: Selenium (or Cypress/Playwright); JMeter (or k6); OWASP ZAP (or Burp Suite); Postman.
📜 Past-Paper Questions & MCQs (CSS 2016–2026)
2022 · Paper-II · Q8(a) · 8 marks
Q. Explain the process of web application testing.
Ans.
- Aim: find errors in content, function, interface, navigation, performance and security before users do. Web apps need extra care because of many browsers, devices and users.
- Process:
- 1. Plan the testing: scope, risks, environment and tools.
- 2. Design test cases from requirements.
- 3. Execute the tests (manual and automated) and record results.
- 4. Report defects and have them fixed.
- 5. Re-test and run regression tests.
- Types of testing in web applications:
- Content testing: correct spelling, text, images and links (no broken links).
- Interface and usability testing: layout, forms and ease of use.
- Navigation testing: menus, links and the path between pages.
- Functional testing: forms, login, shopping cart and payments.
- Compatibility testing: different browsers, operating systems and screen sizes.
- Performance and load testing: response time and behaviour under many users (JMeter).
- Security testing: SQL injection, XSS, authentication and session handling.
- Database testing and accessibility testing.
- Tools: Selenium (automation), JMeter (load), Lighthouse (performance and accessibility), and Postman (APIs).