10 Questions due in 2 hours
Sharfuk9t
it355unit10.pptxIT355 Unit 10 – Testing Web Applications
Fall 2016
Dr Diane Murphy
11/1/2016
1
1
Topics
Content vs. software vs. databases
User environments
Browser compatibility
System upgrades
Security implications
Risks associated with new applications
Testing the effectiveness of integrating new technologies
11/1/2016
2
2
Web Site Testing
Web sites are essentially client/server applications
Web server, database server, etc
Browser is client on any platform
Considerations
HTML/CSS/JavaScript/Flash/Silverlight/Ajax page
TCP/IP communications
Internet connections
Firewalls and their impact
Applications that run on a range of servers
3
3
Additional Considerations
Wide variety of servers and browsers
Various versions of each
Small but sometimes significant differences between them
New versions constantly being introduced
Variations in connection speeds and screen sizes
Rapidly changing technologies
Load balancing
Content distribution networks
Multiple standards and protocols
11/1/2016
4
4
Types of Testing
White-box testing for client functions
HTML
CSS
JavaScript
Ajax
Black-box testing for server functions
Load balancers
Web server(s)
Applications server
Database server
11/1/2016
5
5
Questions To Think About
Who is the target audience?
What kind of browsers will they be using?
What kind of connection speeds will they be using?
Are they intra-organization (thus with likely high connection speeds and similar browsers) or Internet-wide (thus with a wide variety of connection speeds and browser types)?
What kind of performance is expected on the client side (e.g., how fast should pages appear, how fast should applets, etc. load and run)?
11/1/2016
6
6
Questions to Answer
What are the expected loads on the server (e.g., number of hits per unit time?)
What kind of performance is required under such loads (such as web server response time, database query response times)
What kinds of tools will be needed for performance testing (such as web load testing tools, other tools already in house that can be adapted, web robot downloading tools, etc.)?
11/1/2016
7
7
More Questions
Will down time for server and content maintenance/upgrades be allowed? how much?
What kinds of security (firewalls, encryptions, passwords, etc.) will be required and what is it expected to do? How can it be tested?
How reliable are the site’s Internet connections required to be? And how does that affect backup system or redundant connection requirements and testing?
11/1/2016
8
8
More Questions
What processes will be required to manage updates to the web site’s content?
What are the requirements for maintaining, tracking, and controlling page content, graphics, links, etc.?
Which HTML specification will be adhered to? How strictly? What variations will be allowed for targeted browsers?
Will there be any standards or requirements for page appearance and/or graphics throughout a site or parts of a site??
11/1/2016
9
9
More Questions
How will internal and external links be validated and updated? how often?
Can testing be done on the production system, or will a separate test system or staging server be required?
How are browser caching, variations in browser option settings, dial-up connection variabilities, and real-world internet ‘traffic congestion’ problems to be accounted for in testing?
How extensive or customized are the server logging and reporting requirements; are they considered an integral part of the system and do they require testing?
11/1/2016
10
10
More Questions
How are cgi programs, applets, JavaScript, ActiveX components, etc. to be maintained, tracked, controlled, and tested?
How long are pages? Are they 3-5 screens max unless content is tightly focused on a single topic? If larger, are internal links provided within the page?
11/1/2016
11
11
More Questions
Are page layouts and design elements be consistent throughout a site, so that it’s clear to the user that they’re still within a site?
Are pages as browser-independent as possible, or are pages provided or generated based on the browser-type?
Do all pages have links external to the page; there should be no dead-end pages?
Is the page owner, revision date, and a link to a contact person or organization included on each page?
11/1/2016
12
12
Web Testing Checklist
Functionality Testing
Usability testing
Interface testing
Compatibility testing
Performance testing
Security testing
11/1/2016
13
13
1. Functionality Testing
“Testing that bases its test cases on the specifications of the component under test”
Make sure the Web page does what it is intended to do
Test all forms used in the web pages for submitting or getting information from users
Make additional checks on functionality that seem appropriate
11/1/2016
14
14
Basic Testing
How do you get to the page?
Test the link to the page by entering URL
Is it accessible from a search engine?
Does the page display correctly and it is easy to understand its functionality?
Does the page do what it says it will do?
Can you display any embedded information such as a pdf file?
11/1/2016
15
Validate Metatags
If you are optimizing your site for search engines then HTML/CSS validation is very important
Verify metatags to ensure that effective and do not validate copyright
Mainly validate the site for HTML syntax errors and Search Engine Optimization (SEO)
Check if site is crawlable to different search engines
Check search engine presence
11/1/2016
16
16
Tests for Navigation
Navigation means how the user surfs the web pages
Need to test the different controls like buttons, boxes or how user using the links on the pages to surf different pages
If a menu is provided on each page, it should be consistent
Links can and do change so need to test often
Tools to check automatically
11/1/2016
17
17
Content Checking
Content should be logical and easy to understand
Check for spelling and grammatical errors
Use of contrasting colors
Section 508 compliance if government site
Follow some standards that are used for web page and content building
Content should be meaningful
No typos
Images should be placed properly with proper sizes
11/1/2016
18
18
Help Features
Help features include search option, sitemap, help files etc
Sitemap should include all the links in web sites with proper tree view of navigation
Check for all links on the sitemap
“Search in the site” option helps users to find content pages they are looking for quickly
These are all optional items and if present should be validated
11/1/2016
19
19
2. Usability Testing
“Verifies the ease with which a user can learn to operate, prepare inputs for, and interpret outputs of a system or component”
Web site should be easy to use
Instructions should be provided clearly so check if the provided instructions are correct
Some basic standards that should be followed in web development
Validate all for user interface (UI) testing
11/1/2016
20
20
Why do websites have problems?
Many design sites for people to read them
Instant access has made us impatient
People don’t read, they scan1
80% of web users give the Web site several seconds to get their attention
Usability testing helps provide a clear path for the website users
Website Usability Testing
1Jacob Nielson October 1997 “How Users Read on the Web”
21
Healthcare.gov Example from www.nngroup.com
Allow users to see the product/information before registering
Keep calls to action and other pertinent information above the fold
Prepare the users
Number the steps
Use email as username
Simplify password requirements
Provide specific and actionable rror messages
Display passwords as users type them
Remove unnecessary steps
Simplify instructions and content for low-literacy readers
11/1/2016
22
11/1/2016
23
11/1/2016
24
11/1/2016
25
11/1/2016
26
Summary
Create real world tasks from site goals
Recruit from target market(s)
Use 3 subjects per test period
Test early and often
Encourage out loud thinking from test subjects
Don’t over analyze – just start doing it!
Website Usability Testing
27
3. Interface Testing
“Testing conducted to evaluate whether systems or components pass data and control correctly to one another. It is usually performed by both testing and development teams”
For Web it includes:
Making sure that links work
Interaction between the browser and server particularly when data is entered or displayed
Interaction with database in backend
Interaction with other applications, such as Adobe Reader for pdf files
11/1/2016
28
Checking Links
Test the outgoing links from all the pages from specific domain under test
Test all internal links
Test links jumping on the same page
Test links used to send the email to admin or other users from web pages
Test to check if there are any orphan pages
Pages no longer used in application but Web page still on the server
11/1/2016
29
29
Testing Forms
Forms are the integral part of many web sites
Forms are used to get information from users and to keep interaction with them
So what should be checked on these forms?
First check all the validations on each field
Check for the default values of fields
Validate that wrong inputs to the fields in the forms give appropriate messages
Check any Javascript appliation
11/1/2016
30
30
Cookies Testing
Cookies are basically used to maintain the session mainly login sessions
Test the application by enabling or disabling the cookies in your browser options
Test if the cookies are encrypted before writing to user machine
If you are testing the session cookies (i.e. cookies expire after the sessions ends) check for login sessions and user stats after session end
Check effect on application security by deleting the cookies
11/1/2016
31
31
Database Testing
Data consistency is very important in web application
Test database connection and what happens when database not available or fails
Check for data integrity and errors while you edit, delete, modify data on the forms or do any DB related functionality
Check if all the database queries are executing correctly, data is retrieved correctly and also updated correctly
11/1/2016
32
32
4. Compatibility Testing
“Validates how well a software performs in a particular hardware/software/operating system/network environment”
For Web applications, three main characteristics:
Computer/operating system (MAC, PC, etc)
Browser: type and version
Screen resolution
Connectivity to Internet may also be an issue
11/1/2016
33
5. Performance Testing
“Evaluates the compliance of a system or component with specified performance requirements”
Especially important for Web applications when server can crash if it becomes overloaded
Important to identify the breaking point so that can track number of visits or “hits” on an ongoing basis
11/1/2016
34
Browser Issues
Can do some limited performance testing on the browser
Factors that might affect machine performance might be:
Disk space availability
Machine memory
Other programs running on machine
Internet connectivity speed
11/1/2016
35
6. Security Testing
“A process to determine that an information system protects data and maintains functionality as intended”
Most important if personally identifiable information is identified (PII)
Make sure use https: when such information (e.g. credit card information is used)
Verify information that is stored in the cookie to identify you either directly or through a third party
11/1/2016
36
Why the Web is Vulnerable?Security
Host
Apps
Firewall
Host
Apps
Database
Host
Web server
App server
DB server
| Securing the application | ||
| Input validation | Session mgmt | Authentication |
| Authorization | Config mgmt | Error handling |
| Secure storage | Auditing/logging |
| Securing the network |
| Router |
| Firewall |
| Switch |
| Securing the host | ||
| Patches/updates | Accounts | Ports |
| Services | Files/directories | Registry |
| Protocols | Shares | Auditing/logging |
Firewall
Note that security is often begun in the network and host boxes, but application security requires work at the top box (application layer)
©2007 Ernst & Young Advanced Security Center
November 1, 2016
37
HTTP is stateless and hence requests and responses to communicate between browser and server have no memory
Most typical HTTP requests utilise either GET or POST methods
Scripting can occur on:
Server-Side (e.g. perl, asp, jsp)
Client-Side (javascript, flash, applets)
Web server file mappings allow the web server to handle certain file types using specific handlers (ASP, ASP.NET, Java, JSP,CFM etc)
Data is posted to the application through HTTP methods, this data is processed by the relevant script and result returned to the user’s browser
Web Application Behaviour
38
HTTP POST HTTP GET
“GET” exposes sensitive authentication information in the URL
In Web Server and Proxy Server logs
In the http referer header
In Bookmarks/Favorites often emailed to others
“POST” places information in the body of the request and not the URL
Enforce HTTPS POST For Sensitive Data Transport
39
What are HTTP Headers?
HTTP headers are components of the message header of HTTP Requests and Responses
HTTP headers define different aspects of an HTTP transaction
HTTP headers are colon-separated name-value pairs in clear-text string format, terminated by a carriage return (CR) and line feed (LF) character sequence.
Firewalls
Functionality of a site can be impacted by other factors
Firewalls may be in two place:
Browser may have to go through firewall to get to the Internet
Server and/or backend databases may be behind one of more firewalls
Firewalls may prevent certain messages from being transmitted that may affect the functionality
11/1/2016
41
Browser Controls
Browsers can be set to limit what web content is assessed or displayed on the screen
Most browsers allow for user control of:
Security setting based on some black list of sites, general or controlled by the user
Control over permanent cookies
Control over “active content” such as Java
Set most restrictive settings to test what happens to the software
11/1/2016
42
Activity 10: Test Cases for Web
In groups, write down at least ten test cases to test part of the Canvas Web application:
Modules
Content pages
Quizzes
Grades
Assignments
Library Resources
To Do List
People
Upload to Canvas with your site name as the document title
11/1/2016
43
43
