QAble

Browse by type

Explore all services
Functional
Functional Testing
End-to-end feature validation
Software Testing
Full-stack QA across disciplines
Software QA
Process, standards & audit QA
Independent Testing
Vendor-neutral V&V & sign-off
Cyber Security Testing
Pen testing & exploit validation
Enterprise Testing
ERP, CRM & core platform QA
Manual Testing
Human-driven QA testing
Exploratory Testing
Discover hidden edge cases
User Acceptance Testing
Business-aligned validation
Usability Testing
Real user experience testing
UI/UX Testing
Interface & interaction QA
Accessibility Testing
WCAG compliance testing
Accessibility Audit
Compliance gap assessment
Accessibility Remediation
Fix accessibility violations
Digital Accessibility
End-to-end inclusive design QA
Security & VAPT
Vulnerability assessment
VAPT Testing
Penetration testing & compliance
Performance Testing
Load & stress testing
Non-Functional Testing
Performance, security & reliability
Compatibility Testing
Cross-device & browser QA
Scalability Testing
Capacity & growth QA
Agile Testing
Sprint-aligned QA
Localization Testing
Language & regional QA
Digital Testing
Digital experience QA

What's New

Solution

Tesbo-X, Playwright Automation Framework

Intelligent test selection, parallel CI execution, and rich trace reporting unified in a single automation system.

Try for Free →
View all services
About UsWhy QAbleCertificationsCareers
Knowledge HubBlogQAble WeeklyCase StudiesEbooksUtilities
BetterBugs
BetterBugs
Tesbo-X
Tesbo-X
Talk to QA Advisor
Browse the Knowledge Hub74 resources
/Test Cases/iOS lifecycle and permission test cases

Test cases

iOS test cases, for the credential that survives uninstall

Twenty eight cases covering the keychain persisting through deletion, suspended app termination with no callback, background task limits and disabled refresh, limited photo access, allow once location, tracking transparency, biometric invalidation, app switcher snapshots, universal links and VoiceOver.

28cases/8coverage types/8security cases/FreeCSV download

All 28 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

28 worked examples

IOS-01

Restore state after the app is terminated while suspended

TypeStatePriorityHigh
Test data
Fill a form, background the app, force the system to reclaim it, then relaunch
Expected result
Screen and entered values are restored. A suspended app is terminated without warning under memory pressure and receives no callback when it happens.
IOS-02

Handle backgrounding and foregrounding cleanly

TypeStatePriorityHigh
Test data
Background mid request, wait, then return
Expected result
In flight work resumes or is retried once, no duplicate request is issued, and the interface does not display a stale loading state indefinitely.
IOS-03

Complete background work within the allotted time

TypeBoundaryPriorityHigh
Test data
Start an upload and immediately background the app
Expected result
Work continues through a background task or background session and completes, rather than being suspended partway with no indication to the user.
IOS-04

Behave correctly when background refresh is disabled

TypeNegativePriorityHigh
Test data
Disable background app refresh in system settings, then expect a background update
Expected result
App detects the restriction and updates on foreground instead, rather than presenting stale data as current with no explanation.
IOS-05

Preserve credentials only when intended after reinstall

TypeSecurityPriorityHigh
Test data
Sign in, delete the app, reinstall, then launch
Expected result
Documented behaviour applied deliberately. The keychain survives uninstall, so an app that reads it blindly signs the user back into an account they thought they removed.
IOS-06

Handle a keychain entry from an older version

TypeCompatibilityPriorityHigh
Test data
A credential written in an older format read by the current build
Expected result
Migrated transparently or discarded with a clean sign out, never left in a state where every request fails with no explanation.
IOS-07

Respect keychain accessibility on a locked device

TypeSecurityPriorityHigh
Test data
Trigger a background fetch requiring the credential while the device is locked
Expected result
Accessibility class matches the need, so a credential intended to be unavailable while locked is not readable, and background work does not fail unexpectedly.
IOS-08

Request each permission at the point of need

TypeFunctionalPriorityHigh
Test data
Camera, photo library, location, notifications and tracking prompts
Expected result
Each is requested when the feature is used, preceded by an in app explanation, and the system usage description text accurately matches the purpose.
IOS-09

Remain usable when a permission is denied

TypeNegativePriorityHigh
Test data
Deny each permission and continue using the app
Expected result
Feature degrades with an explanation and a route to settings, and the rest of the app continues to work rather than presenting a dead screen.
IOS-10

Detect a permission changed in Settings

TypeStatePriorityHigh
Test data
Grant a permission, background the app, change it in Settings, then return
Expected result
Rechecked on foreground rather than cached, since iOS may relaunch the app after certain changes and stale assumptions crash on the next call.
IOS-11

Handle limited photo library access

TypeBoundaryPriorityHigh
Test data
Grant access to selected photos only, then attempt to browse the library
Expected result
Only the selected items are visible, the app offers a way to change the selection, and it does not treat limited access as a denial.
IOS-12

Handle location granted once only

TypeBoundaryPriorityHigh
Test data
Choose allow once, then background and return to a location dependent feature
Expected result
Permission is re-requested appropriately rather than the feature silently failing, and the app does not prompt repeatedly within one session.
IOS-13

Handle the tracking prompt outcome

TypeSecurityPriorityHigh
Test data
Decline app tracking transparency, and disable it globally in Settings
Expected result
No cross app identifier is accessed, analytics degrade rather than break, and no alternative identifier is used to reconstruct tracking.
IOS-14

Handle notification permission and provisional delivery

TypeFunctionalPriorityHigh
Test data
Decline notifications, then rely on them for a time sensitive flow
Expected result
Critical information is available in app, and notification categories are used so the user can allow one type without allowing all of them.
IOS-15

Open a universal link into the correct screen

TypeStatePriorityHigh
Test data
A universal link opened cold, warm, and while signed out
Expected result
Lands on the target in all three, the destination survives authentication, and the link does not bounce to the browser when the app is installed.
IOS-16

Fall back when universal link association fails

TypeNegativePriorityMedium
Test data
The association file unreachable or invalid
Expected result
Opens in the browser cleanly rather than failing silently, and the web page offers the equivalent journey.
IOS-17

Handle interruptions during a task

TypeStatePriorityHigh
Test data
An incoming call, a system alert, control centre and the app switcher during a form and during playback
Expected result
Media pauses and resumes, entered data survives, and no request is duplicated by the interruption and resume cycle.
IOS-18

Handle biometric authentication and its failures

TypeSecurityPriorityHigh
Test data
Successful biometric, a failed attempt, a cancelled prompt, and biometrics disabled at system level
Expected result
Each is distinguishable, a passcode fallback exists, and a cancellation is not treated as a successful authentication.
IOS-19

Invalidate credentials when biometrics change

TypeSecurityPriorityHigh
Test data
Enrol a new fingerprint or face after storing a biometric protected credential
Expected result
Stored credential is invalidated and re-authentication is required, so adding a biometric does not grant access to an existing session.
IOS-20

Protect content in the app switcher snapshot

TypeSecurityPriorityHigh
Test data
Background the app from a screen showing sensitive data
Expected result
Snapshot is obscured, since the system captures the visible screen and it remains readable in the app switcher to anyone holding the device.
IOS-21

Support Dynamic Type and larger accessibility sizes

TypeAccessibilityPriorityHigh
Test data
Every screen at the largest accessibility text size
Expected result
Text scales, layouts reflow, nothing is clipped or overlapped, and no control needed to complete a task becomes unreachable.
IOS-22

Complete key journeys with VoiceOver

TypeAccessibilityPriorityHigh
Test data
VoiceOver enabled through sign in, a form and a modal presentation
Expected result
Every element is labelled with its role and state, focus moves correctly on presentation and dismissal, and custom controls announce their purpose.
IOS-23

Adapt to safe areas and device shapes

TypeCompatibilityPriorityHigh
Test data
The smallest supported device, one with a dynamic island, and an iPad in both orientations
Expected result
No control sits under a system element or home indicator, and layouts adapt rather than scaling a phone layout onto a tablet.
IOS-24

Behave correctly on the oldest supported iOS version

TypeCompatibilityPriorityHigh
Test data
Core journeys on the minimum supported version and on the newest
Expected result
Every journey completes on both, and any feature depending on a newer API degrades rather than crashing on the older one.
IOS-25

Handle low power mode and low storage

TypeNegativePriorityMedium
Test data
Low power mode enabled during background work, and storage filled before a save
Expected result
Reduced background activity is handled gracefully, save failures are reported clearly, and no corrupt file is written.
IOS-26

Restore correctly from an encrypted device backup

TypeStatePriorityMedium
Test data
Restore the app onto another device from a backup
Expected result
App launches into a valid state, credentials behave per the documented rule, and no cached data belonging to the previous device is presented as current.
IOS-27

Handle a push notification in every app state

TypeStatePriorityHigh
Test data
A push received in foreground, background and terminated states, then tapped
Expected result
Handled in all three and the tap routes to the correct screen, including when the app was terminated and must cold start into the destination.
IOS-28

Recover from a crash without losing user work

TypeStatePriorityHigh
Test data
Force a crash during an unsaved edit, then relaunch
Expected result
Draft is recoverable, the crash is reported with enough context to diagnose, and relaunch does not immediately crash again.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based. Anything that loses user work on suspension, restores a credential the user believed removed, or leaves a permission denied feature broken is High. Review guideline violations are High because they block release.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Delete the app, then reinstall it

These four are the iOS specific conditions that a test plan written for Android will not contain.

Reinstall and see who you are

The keychain survives deletion. An app that reads it blindly signs the user straight back into the account they thought they had removed, with stale state around it.

Grant selected photos only

Limited access is not denial, and treating it as such breaks the feature for anyone who chose it. The app also needs a route to change the selection.

Background from a sensitive screen

The system captures the visible screen for the app switcher, and it stays readable to anyone holding the device. Obscuring that snapshot is one line and routinely missed.

Enrol a new face or fingerprint

A biometric protected credential must be invalidated when the enrolled set changes, otherwise adding a biometric grants access to somebody else existing session.

What Most Sets Miss

Why iOS defects surface after release

The keychain outliving the application is the iOS behaviour that surprises teams most, and it produces a genuinely confusing bug report: a user deletes the app to sign out, reinstalls, and finds themselves signed in as before. Whether credentials should persist is a product decision, but it has to be a decision rather than a default. The related cases are a keychain entry written by an older version that the current build cannot parse, and an accessibility class that makes a credential unreadable while the device is locked, which breaks background work in a way that only appears on locked devices.

Termination on iOS is quieter than on Android. A suspended app is reclaimed under memory pressure with no callback at the moment it happens, so any state not already persisted is gone and the app has no opportunity to save it on the way out. That makes state restoration something to design for rather than handle reactively, and it means the test is to force the reclaim and relaunch rather than to background and return.

The permission model has intermediate states that behave badly when treated as binary. Limited photo library access is not a denial, and an app that reads it as one breaks for every user who chose it. Allow once expires in a way that needs handling without prompting repeatedly within a session. Background app refresh disabled at system level means scheduled updates simply never run, and presenting stale data as current with no explanation is how that becomes a support ticket. And declining tracking transparency must genuinely stop cross app identification rather than being routed around, which is both a guideline requirement and a release blocker.

Finally, two things that only appear on real hardware. The app switcher snapshot captures whatever was on screen when the app was backgrounded, and it remains visible to anyone holding the device, so a screen showing financial or health data needs obscuring. And Dynamic Type at the largest accessibility sizes reflows every layout: fixed heights clip, controls overlap, and something needed to complete a task ends up unreachable. Neither reproduces in a simulator at default settings, which is where most iOS testing happens.

Suggest an improvement

Testing an iOS app?

QAble tests iOS apps on real devices across versions, including state restoration, the full permission model, keychain behaviour, biometrics and VoiceOver.

iOS app testing services

More test case sets

View all

Test cases for a login page

Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for a registration form

Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.

Test cases for search functionality

Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for forgot password

Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.

Test cases for OTP verification

Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.

Test cases for user roles and permissions

Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for form validation

Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.

Test cases for a date picker

Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for push notifications

Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.

Test cases for reports and data export

Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.

Test cases for a chatbot

Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for subscription and billing

Test cases28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.

Test cases for data tables, filters and sorting

Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for performance and load

Test cases28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.

Test cases for the OWASP Top 10

Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Test cases for outbound webhooks

Test cases28 cases on retry backoff and dead letter stores, one dead consumer degrading the pipeline, payload signing and replay windows, out of order delivery and endpoint SSRF.

Test cases for background jobs and queues

Test cases28 cases on work outliving the visibility timeout, idempotent handlers, poison messages, priority starvation, scheduler overlap across instances and graceful drain.

Test cases for real time features and websockets

Test cases28 cases on messages lost in the reconnect gap, half open connections, per channel authorisation, tokens expiring mid connection, backpressure and fanout across instances.

Test cases for file storage and media processing

Test cases28 cases on signed URL scope and expiry, serving before scanning completes, content type sniffing, metadata stripping, orphaned objects and derivative failures.

Test cases for CSV import and bulk operations

Test cases28 cases on reruns duplicating successes, delimiters inside quoted fields, byte order marks, leading zeros, ambiguous dates and bulk action scope.

Test cases for feature flags and progressive rollout

Test cases28 cases on unreachable flag services, unstable bucketing, rollouts that reshuffle users, kill switch latency, server and client mismatch and stale flags.

Test cases for Android app lifecycle and permissions

Test cases28 cases on state lost to process death, configuration changes, permanent permission denial, revocation while backgrounded, doze and battery restrictions.

Test cases for wearable app sync

Test cases28 cases on data recorded away from the phone, duplicate records on resync, full buffers, clock drift, health permissions, battery budgets and unworn readings.

Test cases for VR and AR experiences

Test cases28 cases on the frame rate comfort floor, tracking loss, guardian boundaries, involuntary camera movement, AR anchor drift and spatial data privacy.

Test cases for IoT device pairing and telemetry

Test cases28 cases on offline buffering and reconnect floods, fleet wide reconnection storms, shared credentials, wrong device clocks and stale queued commands.

Test cases for embedded firmware update

Test cases28 cases on power loss mid write, automatic rollback and health confirmation, signature and anti rollback checks, staged rollouts and recovery mode.

Test cases for user profile and account settings

Test cases28 cases on partial saves reported as success, optimistic updates the server rejected, mass assignment through a profile form, avatar content inspection and session invalidation.

Test cases for account deletion and data export

Test cases28 cases on export links that must be authorised and expiring, deletion cascading to storage, caches, logs and processors, grace periods, legal holds and deadlines.

Test cases for consent and cookie management

Test cases28 cases on cookies and tracking requests firing before consent, reject parity with accept, tag manager bypass, withdrawal, cached banners and server side forwarding.

Test cases for notification preferences and delivery

Test cases28 cases on opt outs honoured on one channel and ignored on another, marketing sent as transactional, unsubscribe scope, imports resetting consent and digest timezones.

Test cases for admin impersonation and support access

Test cases28 cases on actions attributed to the customer instead of the admin, credential exposure, chained and upward impersonation, session expiry and immutable access records.

Test cases for audit logs and activity history

Test cases28 cases on forged entries through log injection, immutability and tamper detection, actor attribution across impersonation and jobs, retention and legal holds.

Want your iOS behaviour proven, not assumed?

QAble covers functional, state and security paths with ISTQB-certified engineers. Start with a free QA audit of your app.

Talk to QA Advisor