Testing ASP.NET Web Applications

7.4. Breaking the Application

When testing ASP.NET web applications there are various common test cases you can attempt to ensure you haven't missed anything obvious. Based on these tips and together with the advice provided previously you should have a good initial base to start manually testing your application.

7.4.1. Session Timeouts

As discussed in the "Usability" section, session timeouts are a great way to test applications to see what breaks. The problem arises when, as the name implies, the session state has timeout. This occurs when a user has left a browser window open for a period of time. When they return they navigate to a section of the site which attempts to read the session information and fails because it has unexpectedly been recycled. One way to test this would be to leave a browser window open for 20 minutes until the timeout occurred. This would be a very lengthy process. A more productive approach is to override the default timeout for the test site. This is set in the web.config of the site. If you set the timeout to 1, then you will only have to wait one minute before navigating to see the effects:

<configuration>
  <sessionstate timeout="1" />
</configuration>

Remember to make sure that this setting is not deployed into production. Another way to identify potential problems is to code-review the pages to see which ones deal with the session. If the page doesn't deal with any session state, then there is not much point in testing it.

Another way is to force ...