23-09-2024
Testing Web-based
System
Dr. Madhusmita Sahu
Assistant Professor
Department of Computer Science and Information Technology
Topics to be discussed
Web-based System
Traditional Software and
Web-based Software
Challenges in Testing for
Web-based Software
Testing of Web-based
Systems
2
1
23-09-2024
Web-based System
▸ The growing number of web applications
combined with an ever-growing Internet user
mass, emphasizes the importance of developing
high-quality products.
▸ However, many attributes of quality web based
systems such as ease of navigation, accessibility,
scalability, maintainability, usability, compatibility
and interoperability, security, readability, and
reliability are not given due consideration during
development.
3
Web-based System
▸ Therefore, proper testing of web based systems is
needed in ensuring reliable, robust, and high-
performing operation of web applications.
▸ The web-based software system consists of a set
of web pages and components that interact to
form a system which executes using web
server(s), network, HTTP, and a browser, and in
which user input affects the state of the system.
2
23-09-2024
Web-based System
▸ Thus, web-based systems are typical software
programs that operate on the Internet,
interacting with the user through an Internet
browser.
Terms related to Web-based System
▸ Web page is the information that can be viewed
in a single browser window.
▸ Awebsite is a collection of web pages and
associated software components that are related
semantically by content and syntactically through
links and other control mechanisms.
▸ Websites can be dynamic and interactive.
3
23-09-2024
Terms related to Web-based System
▸ A web application is a program that runs as a
whole or in part on one or more web servers and
that can be run by users through a website.
▸ Web applications require the presence of web
server in simple configurations and multiple
servers in more complex settings.
▸ Such applications are called web based
applications.
Terms related to Web-based System
▸ Similar applications, which may operate
independent of any servers and rely on operating
system services to perform their functions, are
termed web-enabled applications.
▸ These days, with the integration of technologies
used for the development of such applications,
there is a thin line separating web-based and
web-enabled applications, so we collectively refer
to both of them as web applications.
4
23-09-2024
Traditional Software and Web-based Software
▸ Web systems are based on client-server
architecture wherein a client typically enables
users to communicate with the server.
▸ Therefore, these systems share some
characteristics of client-server architecture.
▸ However, there are a number of aspects of web
systems that necessitate having different
techniques to test them.
Traditional Software and Web-based Software
▸ These are
▸ Clients of the traditional client-server systems
are platform-specific.
▸ This means that a client application is
developed and tested for each supported
client operating system.
▸ But the web client is operating within the
web browser's environment.
10
5
23-09-2024
Traditional Software and Web-based Software
▸ Web browsers already consist of operating
system-specific client software running on
a client computer.
▸ But these browsers need to support HTML,
as well as active contents to display web
page information.
11
Traditional Software and Web-based Software
▸ For this purpose, browser vendors must
create rendering engines and interpreters
to translate and format HTML contents.
▸ In making these software components,
various browsers and their releases
introduce incompatibility issues.
12
6
23-09-2024
Traditional Software and Web-based Software
▸ Web-based systems have a more dynamic
environment as compared to traditional
client-server systems.
▸ In client-server systems, the roles of the
clients and servers and their interaction
are predefined and static as compared to
web applications where client side
programs and contents may be generated
dynamically.
13
Traditional Software and Web-based Software
▸ Moreover, the environment for web
applications is not predefined and is
changing dynamically i.e. hardware and
software are changing, configuration are
ever-changing, etc.
▸ Web applications often are affected by
these factors that may cause
incompatibility and interoperability issues.
14
7
23-09-2024
Traditional Software and Web-based Software
▸ In the traditional client-server systems, the
normal flow of control is not affected by the
user.
▸ But in web applications, users can break
the normal control flow.
▸ For example, users can press the back or
refresh button in the web browser.
15
Traditional Software and Web-based Software
▸ Due to the dynamic environment, web
systems demand more frequent maintenance.
▸ The user profile for web systems is very
diverse as compared to client-server systems.
▸ Therefore, the load on web access due to
this diversity is not predictable.
16
8
23-09-2024
Challenges in Testing for Web-based Software
Diversity and complexity
01
Dynamic environment
02
Very short development
Challenges 03 time
Continuous evolution
04
Compatibility and
05 interoperability
17
Diversity and complexity
▸ Web applications interact with many components
that run on diverse hardware and software
platforms.
▸ They are written in diverse languages and they
are based on different programming approaches
such as procedural, OO, and hybrid languages
such as Java Server Pages (JSPs).
▸ The client side includes browsers, HTML,
embedded scripting languages, and applets.
18
9
23-09-2024
Diversity and complexity
▸ The server side includes CGI, JSPs, Java Servlets,
and .NET technologies.
▸ They all interact with diverse back-end engines
and other components that are found on the web
server or other servers.
19
Dynamic environment
▸ The key aspect of web applications is its dynamic
nature.
▸ The dynamic aspects are caused by uncertainty
in the program behaviour, changes in application
requirements, rapidly evolving web technology
itself, and other factors.
▸ The dynamic nature of web software creates
challenges for the analysis, testing, and
maintenance for these systems.
20
10
23-09-2024
Dynamic environment
▸ For example, it is difficult to determine statically
the application’s control flow because the control
flow is highly dependent on user input and
sometimes in terms of trends in user behaviour
over time or user location.
▸ Not knowing which page an application is likely to
display hinders statically modeling the control
flow with accuracy and efficiency.
21
Very short development time
▸ Clients of web-based systems impose very short
development time, compared to other software
or information systems projects.
▸ For e.g. an e-business system, sports website, etc.
22
11
23-09-2024
Continuous evolution
▸ Demand for more functionality and capacity after
the system has been designed and deployed to
meet the extended scope and demands, i.e.
scalability issues.
23
Compatibility and interoperability
▸ There may also be compatibility issues that make
web testing a difficult task.
▸ Web applications often are affected by factors
that may cause incompatibility and
interoperability issues.
▸ The problem of incompatibility may exist on both
the client as well as the server side.
▸ The server components can be distributed to
different operating systems.
24
12
23-09-2024
Compatibility and interoperability
▸ Various versions of browsers running under a
variety of operating systems can be there on the
client side.
▸ Graphics and other objects on a website have to
be tested on multiple browsers.
▸ If more than one browser will be supported, then
the graphics have to be visually checked for
differences in the physical appearance.
25
Compatibility and interoperability
▸ The code that executes from the browser also has
to be tested.
▸ There are different versions of HTML.
▸ They are similar in some ways but they have
different tags which may produce different
features.
26
13
23-09-2024
Testing for Web-based System
▸ Web-based system need to be tested not only to
check whether it does what it is designed to do
but also to evaluate how well it appears on the
(different) web browsers.
▸ Moreover, they need to be tested for various
quality parameters which are a must for these
systems like security, usability, etc.
27
Testing for Web-based System
▸ Test cases should be written covering the
different scenarios not only of the functional
usage but also the technical implementation
environment conditions such as network speeds,
screen resolution, etc.
28
14
23-09-2024
Testing for Web-based System
▸ There may be a number of navigation paths
possible through a web application.
▸ Therefore, all these paths must be tested.
▸ Along with multiple navigation paths, users may
have varying backgrounds and skills.
▸ Testing should be performed keeping in view all
the possible categories of users in view.
▸ This becomes the issues in usability testing.
29
Testing for Web-based System
▸ Another issue of great concern is the security
testing of web applications.
▸ There are two cases.
▸ For Intranet-based applications, there are no such
threats on the application.
▸ However, in case of Internet-based applications,
the users may need to be authenticated and
security measures may have to be much more
stringent.
▸ Test cases need to be designed to test the various
scenarios and risks involved.
30
15
23-09-2024
Testing for Web-based System
▸ Traditional software must be tested on different
platforms, or it may fail in some platforms.
▸ Similarly, web-based software must be tested
with all the dimensions which are making it
diverse.
31
Testing for Web-based System
Performance Interface
Testing 07 01 Testing
Usability
Security 06 Web-
based
02 Testing
Testing Content
Testing
Testing
Configuratio
n/Compatibili 05 03 Navigation
ty Testing 04 Testing
16
23-09-2024
Interface Testing
▸ The user interface with web application must be
proper and flexible.
▸ Therefore as a part of verification, present model
and web scenarios model must be checked to
ensure all interfaces.
▸ The interfaces between the concerned client and
servers should also be considered.
33
Interface Testing
▸ There are two main interfaces on the server side:
▸ web server and application server interface
and
▸ application server and database server
interface.
▸ All interfaces are checked such that all the
interactions between these servers are executed
properly.
▸ Errors are handled properly.
34
17
23-09-2024
Interface Testing
▸ If database or web server returns any error
message for any query by the application server,
▸ then the application server should catch and
display these error messages appropriately to
users.
▸ Check what happens if the user interrupts any
transaction in between?
▸ Check what happens if connection to web server
is reset in between?
▸ Compatibility of server with software, hardware,
network, and database35should also be tested.
Usability Testing
▸ The presentation design emphasizing the
interface between user and web application gives
rise to usability testing.
▸ Usability testing is not a functionality testing, but
the web application is reviewed and tested from a
user’s viewpoint.
▸ The importance of usability testing can be
realized with the fact that we can even lose users
because of a poor design.
36
18
23-09-2024
Usability Testing
▸ For example, check that form controls, such as
boxes and buttons, are easy to use, appropriate
to the task, and provide easy navigation for the
user.
▸ The critical point for designers and testers in this
attesting is that web application must be as
pleasant and flexible as possible to the user.
37
Usability Testing
▸ Usability testing may include tests for navigation.
▸ It refers to how the user navigates the web pages
and uses the links to move to different pages.
▸ Besides this, content should be logical and easy to
understand.
▸ Check for spelling errors.
▸ Use of dark colours annoy users and should not
be used in the site theme.
38
19
23-09-2024
Usability Testing
▸ Content should be meaningful.
▸ All the anchor text links should work properly.
▸ Images should be placed properly with the proper
sizes.
▸ For verification of web application, the
presentation design must be checked properly so
that most of the errors are resolved at the earlier
stages only.
39
Usability Testing
▸ For validation, a scenario-based usability testing
can be performed.
▸ This type of testing may take the help of use-
cases designed in the use-case model for the
system.
▸ All the use-cases covering usability points can
become the base for designing test cases for
usability testing.
40
20
23-09-2024
Content Testing
▸ The content we see on the web pages has a
strong impression on its user.
▸ If these contents are not satisfactory to him, he
may not visit the web page again.
▸ Check the completeness and correctness
properties of web application content.
41
Content Testing
▸ Check that certain information is available on a
given web page, links between pages exist, or
even check the existence of the web pages
themselves (completeness property).
▸ Furthermore, web application content may need
to be checked against semantic conditions to see
if they meet the web document (correctness
property).
▸ Therefore the contents should be correct, visible,
flexible to use, organized, and consistent.
42
21
23-09-2024
Content Testing
This type of testing targets the testing of static
and dynamic contents of web application
Static contents can be checked as part of
verification.
For instance, forms are the integral part of any
web site.
Forms are used to get information from users and
to keep interacting with them.
First check all the validations on each field.
43
Content Testing
Check for the default values of fields and also
wrong inputs to the fields in the forms.
Options to create forms if any, form delete, view
or modify the forms must also be checked.
44
22
23-09-2024
Content Testing
▸ Static testing may consider the following points
Various layouts.
Check forms for their field validations, error
message for wrong input, optional and
mandatory fields with specified length, buttons
on the form, etc.
A table is present and has the expected
number of rows and columns and pre-defined
properties.
45
Content Testing
Content accuracy and completeness.
Relationship between content objects
Text contents
Text fragments against formatting
expectations.
Graphics content with proper visibility.
Media contents to be placed at appropriate
places.
46
23
23-09-2024
Content Testing
All types of navigation links like internal links,
external links, mail links, broken links to be
placed at appropriate places.
All links on a web page are active.
47
Content Testing
There may be dynamic contents on a web page
also.
Largely dynamic testing will be suitable in testing
these dynamic contents.
These dynamic contents can be in many forms.
One possibility is that constantly changing
contents are there, e.g. weather information web
pages or online news paper.
48
24
23-09-2024
Content Testing
Another case may be that web applications are
generated dynamically from information
contained in a data base or in a cookie.
Many web applications today work interactively in
the manner that in response to a user request for
some information,
it interacts with some DBMS,
extracts the relevant data,
creates the dynamic content objects for this
extracted data and
49
Content Testing
sends these content objects to the user for
display.
In the same manner, the information can be
generated dynamically from cookies also, i.e.
dynamic content objects for cookies are also
there.
50
25
23-09-2024
Content Testing
The problem in the design of these dynamic
contents is
that there may be many errors due to its
dynamic behviour.
Therefore, testing of these dynamic contents
becomes necessary to uncover the errors.
51
Content Testing
Changing contents on a web page must be tested
whether the contents are appearing every time
in the same format.
Moreover, there is consistency between the
changed content and static content.
▸ Test all database interface-related functionality
for all dynamic content objects.
52
26
23-09-2024
Content Testing
▸ Check
▸ if all the database queries are executing
correctly,
▸ data is retrieved correctly, and
▸ also updated correctly.
▸ Load testing or performance testing can also be
done on database.
53
Content Testing
▸ Cookies are small files stored on the user
machine.
▸ These are basically used to maintain the session,
mainly the login sessions.
▸ The testing of the entire interface with these
cookies must also be tested.
▸ Test the application by enabling or disabling the
cookies in browser options.
54
27
23-09-2024
Content Testing
▸ Test if the cookies are encrypted before writing to
user machine.
▸ Check the effect on application security by
deleting the cookies.
55
Navigation Testing
▸ Navigation testing is performed on various possible
paths in web applications
▸ To ensure the functioning of correct sequence of
navigations
▸ Design the test cases such that the following
navigations are correctly executing:
▸ Internal links
▸ External links
▸ Redirected links
▸ Navigation for searching inside the web application
56
28
23-09-2024
Navigation Testing
▸ The errors must be checked during navigation
testing for the following:
▸ The links should not be broken due to any
reason.
▸ The redirected links should be with proper
messages displayed to the user.
▸ Check that all possible navigation paths are
active.
57
Navigation Testing
▸ Check that all possible navigation paths are
relevant.
▸ Check the navigations for the back and
forward buttons, whether they are working
properly.
58
29
23-09-2024
Configuration/Compatibility Testing
Diversity in configuration for web applications
makes the testing of these systems very difficult.
There may be various types of:
Browsers supporting different operating
systems
Variation in servers
Networks, etc.
59
Configuration/Compatibility Testing
Therefore, configuration testing becomes
important so that there is compatibility between
various available resources and application
software.
The tester must consider these configurations and
compatibility issues
so that they can design the test cases
incorporating all the configurations.
60
30
23-09-2024
Configuration/Compatibility Testing
▸ Some points to be careful about while testing
configuration are:
▸ There are a number of different browsers and
browser options.
▸ The web application has to be designed to be
compatible for majority of the browsers.
▸ The graphical and other objects on a website
have to be tested on multiple browsers.
61
Configuration/Compatibility Testing
▸ If more than one browser will be supported,
▸ then the graphics have to be visually
checked for differences in the physical
appearance.
▸ Some of the things to check are
▸ centering of objects,
▸ table layouts,
▸ colours,
62
31
23-09-2024
Configuration/Compatibility Testing
▸ monitor resolution,
▸ forms and
▸ buttons.
The code that executes from the browser also
has to be tested.
There are different versions of HTML.
They are similar in some ways
but they have different tags which may
produce different features.
63
Configuration/Compatibility Testing
Some of the other codes to be tested are
Java,
JavaScript,
ActiveX,
VBScripts,
Cgi-Bin Scripts and
Database access.
64
32
23-09-2024
Configuration/Compatibility Testing
Cgi-Bin Scripts have to be checked for end-
to-end operations and is most essential for
e-commerce sites.
The same goes for database access.
All new technologies used in the web
development like graphics designs, interface
calls like different API’s, may not be available
in all the operating systems.
65
Configuration/Compatibility Testing
Test your web application on different
operating systems like
Windows,
Unix,
MAC,
Linux,
Solaris with different OS flavors.
66
33
23-09-2024
Security Testing
▸ Today, the web applications store more vital data
and the number of transactions on the web has
increased tremendously with the increasing
number of users.
▸ Therefore, in the Internet environment, the most
challenging issue is to protect the web
applications from hackers, crackers, spoofers,
virus launchers, etc.
67
Security Testing
▸ Through security testing, we try to ensure that
data on the web applications remain confidential,
i.e. there is no unauthorized access.
▸ Security testing also ensures that users can
perform only those tasks that they are authorized
to perform.
▸ The web applications must be designed and
developed such that they are able to nullify any
attack from outside.
▸ We need to design the test cases such that the
application passes the 68
security test.
34
23-09-2024
Security Test Plan
▸ Security testing can be divided into two
categories:
▸ testing the security of the infrastructure
hosting the web application and
▸ testing for vulnerabilities of the web
application.
▸ Firewalls and port scans can be the solution for
security of infrastructure.
69
Security Test Plan
▸ For vulnerabilities, user authentication, restricted
and encrypted use of cookies, data
communicated must be planned.
▸ Find all the component interfaces for performing
security testing on a component.
▸ The interfaces are then prioritized according to
their level of vulnerability.
70
35
23-09-2024
Security Test Plan
▸ The high-priority interfaces are tested thoroughly
by injecting mutated data to be accessed by that
interface in order to check the security.
▸ While performing security testing, the testers
should take care that they do not modify the
configuration of the application or the server,
services running on the server, and existing user
or customer data hosted by the application.
71
Various Threat Types and their corresponding Test cases
Unauthorized
1 6
user/Fake
identity/Pass Denial of
word service
cracking
Cross-site
scripting
(XSS) 2 5 SQL
injection
3 4
Buffer URL
overflows manipulation
72
36
23-09-2024
Unauthorized user/Fake identity/Password cracking
▸ When an unauthorized user tries to access the
software by using fake identity, then security
testing should be done such that any
unauthorized user is not able to see the contents/
data in the software.
73
Cross-site scripting (XSS)
▸ When a user inserts HTML/client-side script in the
user interface of a web application and this
insertion is visible to other users, it is called cross-
site scripting (XSS).
▸ Attacker can use this method to execute
malicious script or URL on the victim’s browser.
▸ The tester should additionally check the web
application for XSS.
74
37
23-09-2024
Buffer Overflows
▸ Due to this problem, malicious code can be
executed by the hackers.
▸ In the application, check the buffer overflow
module and the different ways of submitting a
range of lengths to the application.
75
URL manipulation
▸ Communication through HTTP may cause fiddling
of data.
▸ Modification of data passed through HTTP GET
method in the form of query string is known as
fiddling of data.
▸ The tester should check if the application passes
important information in the query string and
design the test cases correspondingly.
76
38
23-09-2024
SQL Injection
▸ Hackers can also put some SQL statements
through the web application user interface into
some queries meant for querying the database to
get vital information from the server database.
▸ Design the test cases such that special characters
from user inputs should be handled/escaped
properly in such cases.
77
Denial of Service
▸ When a service does not respond, it is denial of
service.
▸ There are several ways that can make an
application fail.
▸ For example,
▸ heavy load put on the application,
▸ distorted data that may crash the application,
▸ Overloading of memory, etc.
▸ Design the test cases considering all these
factors.
78
39
23-09-2024
Performance Testing
▸ Performance testing helps the developer to
identify the bottlenecks in the system and can be
rectified.
▸ In performance testing, metrics like response
time, throughput, and resource utilization against
desired values are evaluated.
▸ Bottlenecks for web applications can be code,
database, network, peripheral devices, etc.
79
Performance Parameters
Resource
Throughput Response time Database load Scalability Round-trip time
utilization
• The • The number • The time • The number • The ability of • How long
percentage of of event lapsed of times an application does the
time a responses between a database is to handle entire user-
resource that have request and accessed by additional requested
(CPU, been its reply. web workload, transaction
Memory, I/O, completed application without take,
Peripheral, over a given over a given adversely including
Network) is interval of interval of affecting connection
busy. time. time. performance, and
by adding processing
resources time?
such as
processor,
memory, and
storage
capacity.
71
40
23-09-2024
Types of Performance Testing
Load Stress
Testing Testing
01 02
81
Load Testing
▸ The system should handle many simultaneous
user requests, large input data from users,
simultaneous connection to DB, heavy load on
specific pages, etc.
▸ Load testing is performed on the system when
there is a need to test the application with these
types of loads.
82
41
23-09-2024
Types of Load Testing
• Determine the maximum load the web
Capacity service can handle before failing.
testing • Capacity testing reveals the web
services’ ultimate limit.
Scalability • Determine how effectively the web
service will expand to accommodate
testing an increasing load.
83
Stress Testing
▸ Generally, stress refers to stretching the system
beyond its specification limits.
▸ Web stress testing is performed to break the site
by giving stress and check how the system reacts
to stress and how the system recovers from
crashes.
▸ It focuses on determining or validating
performance characteristics of the system when
subjected to conditions beyond those anticipated
during production operations.
84
42
23-09-2024
Stress Testing
▸ It also tests the performance of the system under
stressful conditions, such as
▸ limited memory,
▸ insufficient disk space, or
▸ server failure.
▸ These tests are designed to determine
▸ under what conditions an application will fail,
▸ how it will fail, and
▸ how gracefully it may recover from the failure.
85
Stress Testing
▸ Some examples of graceful failure are:
▸ the system saves state at the time of failure
and does not crash suddenly;
▸ On restarting it, the system recovers from the
last good state;
▸ the system shows meaningful error messages
to the user.
86
43
23-09-2024
References
• Software Testing: Principles and Practices. Naresh
Chauhan, Oxford University Press, Second
Edition, 2016
87
44