Web Testing Methodologies
Web testing methodology is about structure: how you approach an application so coverage is deliberate rather than random. Understand the components of a web app - client (browser), transport (TLS), server, application logic, and data store - and the trust boundaries between them. Know the testing flow: map the application (crawl, enumerate endpoints, parameters, roles), identify inputs and authentication/authorization points, then test each area against a consistent checklist.
Key concept areas include authentication (login, session management, password reset), authorization (horizontal and vertical access control), input handling (injection, XSS, file upload), and business logic. Understand session tokens: randomness, expiry, transmission over TLS, and flags such as HttpOnly and Secure. Know the difference between reflected, stored, and DOM-based XSS at a conceptual level, and between authentication bypass and authorization bypass.
Trap: candidates confuse authentication with authorization, or test only the happy path and forget role-based access. Another trap is treating client-side validation as a security control - it is not; server-side enforcement is what matters.
Rule of thumb: for every request, ask three questions - who is allowed to make it, what input does it accept, and what does it return? That frames authorization, injection, and data exposure tests.