Module 5 · Web testing

Cookies and sessions

How sign-in state is kept, and the checks that catch session bugs.

About 10 min reading and 10 min practice (estimates)

Loading progress…

Read

Learning objectives

Explain how a session cookie keeps a user signed in.
Read cookie attributes: HttpOnly, Secure, SameSite, expiry.
Design tests for sign-out, expiry and multiple sessions.

Explanation

HTTP is stateless, so after you sign in, the server usually sends a cookie containing a session identifier. The browser sends it back with each request, and the server looks up who you are. Signing out should invalidate that session on the server, not just delete the cookie in the browser.

Attribute	Meaning
HttpOnly	Page scripts can't read the cookie, which limits damage from injected scripts.
Secure	Sent only over HTTPS.
SameSite=Lax / Strict / None	Controls whether the cookie is sent with requests started by other sites. None requires Secure.
Expires / Max-Age	When it expires. Without either, it is a session cookie, removed when the browser session ends.

Example: session test ideas

Sign out, then press Back: protected pages must not show private data, and actions must fail.
Sign in on two browsers, sign out of one: does the other stay signed in, and is that intended?
Change the password: are other sessions signed out?
Copy the session cookie value, sign out, then send a request with the old value: it must be rejected.
Leave the session idle past its expiry: the next action should ask you to sign in, without losing unsaved work silently.

Test only accounts and systems you are allowed to test. Never use someone else's session.

Common mistakes

Assuming sign-out works because the button changed back to "Sign in".
Testing sessions in only one tab.
Ignoring what happens to a half-filled form when the session expires.

Try

Practise what you just read. Answers are checked here; nothing is graded publicly or counts toward Bug Arena.

Exercise

Which of these are good checks for a sign-out feature? Select all that apply.

Select all that apply.

After sign-out, a request with the old session cookie is rejected by the server.
The sign-out button is the brand's gold colour.
After sign-out, pressing Back doesn't reveal private data or allow actions.
Signing out in one tab affects the other tabs of the same browser.

Review

Check yourself — you should now be able to:

Explain how a session cookie keeps a user signed in.
Read cookie attributes: HttpOnly, Secure, SameSite, expiry.
Design tests for sign-out, expiry and multiple sessions.

References

Continue

When you’re ready, mark the lesson complete in the Try step and move on.

Marked as read when you reach the end of the lesson.