QAble

Browse by type

Explore all services
Functional
Functional Testing
End-to-end feature validation
Software Testing
Full-stack QA across disciplines
Software QA
Process, standards & audit QA
Independent Testing
Vendor-neutral V&V & sign-off
Cyber Security Testing
Pen testing & exploit validation
Enterprise Testing
ERP, CRM & core platform QA
Manual Testing
Human-driven QA testing
Exploratory Testing
Discover hidden edge cases
User Acceptance Testing
Business-aligned validation
Usability Testing
Real user experience testing
UI/UX Testing
Interface & interaction QA
Accessibility Testing
WCAG compliance testing
Accessibility Audit
Compliance gap assessment
Accessibility Remediation
Fix accessibility violations
Digital Accessibility
End-to-end inclusive design QA
Security & VAPT
Vulnerability assessment
VAPT Testing
Penetration testing & compliance
Performance Testing
Load & stress testing
Non-Functional Testing
Performance, security & reliability
Compatibility Testing
Cross-device & browser QA
Scalability Testing
Capacity & growth QA
Agile Testing
Sprint-aligned QA
Localization Testing
Language & regional QA
Digital Testing
Digital experience QA

What's New

Solution

Tesbo-X, Playwright Automation Framework

Intelligent test selection, parallel CI execution, and rich trace reporting unified in a single automation system.

Try for Free →
View all services
About UsWhy QAbleCertificationsCareers
Knowledge HubBlogQAble WeeklyCase StudiesEbooksUtilities
BetterBugs
BetterBugs
Tesbo-X
Tesbo-X
Talk to QA Advisor
Browse the Knowledge Hub74 resources
/Test Cases/Push notification test cases

Test cases

Push notification test cases, starting with the wrong recipient

Twenty six cases covering foreground, background and killed app states, deep link routing, token release on sign out, lock screen privacy, permission states, preferences and unsubscribe, quiet hours, provider failures, deduplication and platform differences.

26cases/7coverage types/5security cases/FreeCSV download

All 26 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

26 worked examples

PUSH-01

Receive a notification with the app in the foreground

TypeFunctionalPriorityHigh
Test data
A standard notification while the app is open
Expected result
Handled in app per the design, either as an in app banner or silently updating the relevant screen, without an unexpected system banner over the content the user is reading.
PUSH-02

Receive a notification with the app backgrounded

TypeFunctionalPriorityHigh
Test data
App backgrounded, screen unlocked
Expected result
System notification appears with correct title, body, icon and sound, and tapping it opens the intended screen.
PUSH-03

Receive a notification with the app force closed

TypeStatePriorityHigh
Test data
App swiped away, then a notification sent
Expected result
Delivered and tappable, and a cold start routes to the correct screen. This is the state most often left untested and most often broken.
PUSH-04

Route a deep link payload from every app state

TypeFunctionalPriorityHigh
Test data
The same payload delivered in foreground, background and killed states, and while signed out
Expected result
Each lands on the intended screen with the intended record. Signed out routes to sign in and then continues to the target rather than dropping it.
PUSH-05

Confirm the token is released on sign out

TypeSecurityPriorityHigh
Test data
Sign in as user A, sign out, sign in as user B on the same device, then send a notification for user A
Expected result
User A content never arrives on that device. A token left registered against the previous account is a privacy incident, and it is the single most common defect on this feature.
PUSH-06

Handle token refresh and rotation

TypeStatePriorityHigh
Test data
Force a token refresh, reinstall the app, restore a device backup onto new hardware
Expected result
The new token is registered, the stale one is removed, and delivery continues without the user re-enabling anything.
PUSH-07

Verify content shown on a locked screen

TypeSecurityPriorityHigh
Test data
A notification containing personal or financial detail, device locked
Expected result
Sensitive values are withheld from the preview per platform privacy settings. A balance, a medical detail or a message body on a lock screen is a disclosure the user did not agree to.
PUSH-08

Handle every permission state

TypeSecurityPriorityHigh
Test data
Not yet asked, granted, denied, denied permanently, and revoked in settings while the app runs
Expected result
The app degrades gracefully in each state, never blocks core functionality behind notifications, and does not crash when permission disappears mid session.
PUSH-09

Ask for permission at a sensible moment

TypeFunctionalPriorityMedium
Test data
First launch versus after the user reaches a feature that needs it
Expected result
Rationale shown before the system prompt where the platform expects it, because a refusal at first launch is very hard to recover.
PUSH-10

Honour notification preferences

TypeFunctionalPriorityHigh
Test data
Disable one category, disable all, then trigger both a transactional and a marketing notification
Expected result
Disabled categories are not sent server side rather than being filtered on the device, and any legally required transactional message follows the documented rule.
PUSH-11

Verify unsubscribe and topic changes take effect

TypeStatePriorityHigh
Test data
Leave a topic or unsubscribe, then trigger a message for it
Expected result
Nothing arrives. Continuing to receive messages after unsubscribing is both a trust and a compliance problem.
PUSH-12

Verify badge counts

TypeStatePriorityMedium
Test data
Several notifications, then read some in app and some on another device
Expected result
The badge reflects genuine unread items and clears correctly, including when the item was read elsewhere.
PUSH-13

Verify grouping and collapse behaviour

TypeFunctionalPriorityMedium
Test data
Ten notifications for the same conversation or order
Expected result
Grouped or collapsed by key so the tray is not flooded, and the latest state replaces earlier messages where that is the intent.
PUSH-14

Handle a stale or already resolved notification

TypeStatePriorityHigh
Test data
Send an alert, resolve the underlying event, then tap the notification an hour later
Expected result
The app explains that the item is no longer available rather than opening an empty screen or an error.
PUSH-15

Verify quiet hours, focus modes and do not disturb

TypeCompatibilityPriorityMedium
Test data
Device in do not disturb, plus any in app quiet hours setting
Expected result
Respected, with only genuinely time critical alerts using a high priority channel. Abusing priority is how apps get muted permanently.
PUSH-16

Verify behaviour across multiple devices for one account

TypeStatePriorityHigh
Test data
Two phones and a tablet signed into one account
Expected result
All registered devices receive the notification, and reading on one clears state on the others per the design.
PUSH-17

Verify delivery on a poor or absent connection

TypeStatePriorityHigh
Test data
Device offline when sent, then reconnected within and beyond the message time to live
Expected result
Delivered on reconnection while still valid, silently dropped once expired, and never delivered twice.
PUSH-18

Handle a provider error or rejection

TypeNegativePriorityHigh
Test data
Provider returns an invalid token error, a rate limit response, then a server error
Expected result
Invalid tokens are pruned, rate limits are respected with backoff, and failures are retried without duplicating the message.
PUSH-19

Verify deduplication and rate limiting

TypeSecurityPriorityHigh
Test data
Trigger the same event twenty times in a minute
Expected result
Duplicate messages are collapsed and a per user ceiling applies. Notification floods are an abuse route and a direct cost.
PUSH-20

Verify payload size and truncation

TypeBoundaryPriorityMedium
Test data
A body far longer than the platform limit, plus an oversized data payload
Expected result
Truncated readably rather than rejected by the provider, and the full content is available once the app opens.
PUSH-21

Verify localisation and formatting

TypeCompatibilityPriorityMedium
Test data
Each supported language, plus a name with non Latin characters and a currency amount
Expected result
Text is localised to the user preference rather than the server default, and names, dates and amounts render without corruption.
PUSH-22

Verify silent and data only messages

TypeFunctionalPriorityMedium
Test data
A data only push used to sync content
Expected result
Handled without showing a banner, respecting platform limits on background execution, and never used to work around a user who disabled notifications.
PUSH-23

Verify action buttons on the notification

TypeFunctionalPriorityMedium
Test data
Each action, including one taken from a locked device
Expected result
Actions complete or require authentication where they change data, and the notification updates or dismisses afterwards.
PUSH-24

Verify platform differences

TypeCompatibilityPriorityHigh
Test data
iOS and Android across two OS versions each, plus web push if supported
Expected result
Channels, categories, priority and grouping behave per platform, and any feature missing on one platform degrades rather than breaking.
PUSH-25

Verify accessibility of notification content

TypeAccessibilityPriorityMedium
Test data
Screen reader reading a notification, and large text settings
Expected result
Content is meaningful when read aloud without relying on an emoji or an icon, and the in app inbox is navigable by keyboard and screen reader.
PUSH-26

Verify what is recorded about a notification

TypeSecurityPriorityHigh
Test data
Inspect logs and analytics after sending a notification containing personal content
Expected result
Delivery and open events may be recorded, message content containing personal data is not logged in plain text, and consent state is stored alongside the subscription.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based. Anything that can deliver one person content to another device, or leak private content onto a lock screen, is High. Everything else is a quality of experience question.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Sign out, sign in as someone else

Three states and one identity change account for almost every push defect worth finding.

Swap accounts on one device

Sign in as A, sign out, sign in as B, then send to A. If it arrives, the token was never released, and that is a privacy incident.

Kill the app first

Force close, then send. The killed state has different delivery and routing behaviour and is the one usually skipped.

Read the lock screen

Send a notification containing a balance or a message body and look at the locked device. Previews leak more than teams expect.

Resolve the event, then tap

Notifications outlive the thing they describe. Tapping a stale one must explain itself, not open an empty screen.

What Most Sets Miss

Where push notifications actually go wrong

Token lifecycle is the highest severity gap and the least tested. A device token identifies hardware, not a person, so if sign out does not unregister it and sign in does not rebind it, the next notification for the previous account arrives on a phone now used by someone else. On shared or resold devices, and on any account switch, that is disclosure of one customer content to another. Test it deliberately with two accounts on one device.

The killed app state behaves differently from backgrounded on both platforms, and cold start routing is where deep links break. A payload that opens the right screen from a warm app frequently lands on the home screen from a cold start, or worse, is dropped entirely when the user is signed out. Test all three states against the same payload, including while signed out.

Lock screen previews are a privacy decision that is usually made by default rather than deliberately. Balances, message bodies, medical or legal detail: any of these in a preview is visible to anyone holding the phone. Decide what is safe to show unlocked and assert it.

Finally, preferences and unsubscribe need server side enforcement. Filtering on the device still means the message was sent, which fails an audit and costs money, and a user who unsubscribed and keeps receiving messages will disable notifications permanently rather than complaining.

Suggest an improvement

Shipping a mobile app?

QAble tests notification flows on real devices across iOS and Android, including token lifecycle, cold start routing and provider failure behaviour.

Mobile app testing services

More test case sets

View all

Test cases for a login page

Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for a registration form

Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.

Test cases for search functionality

Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for forgot password

Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.

Test cases for OTP verification

Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.

Test cases for user roles and permissions

Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for form validation

Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.

Test cases for a date picker

Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for reports and data export

Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.

Test cases for a chatbot

Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for subscription and billing

Test cases28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.

Test cases for data tables, filters and sorting

Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for performance and load

Test cases28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.

Test cases for the OWASP Top 10

Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Test cases for outbound webhooks

Test cases28 cases on retry backoff and dead letter stores, one dead consumer degrading the pipeline, payload signing and replay windows, out of order delivery and endpoint SSRF.

Test cases for background jobs and queues

Test cases28 cases on work outliving the visibility timeout, idempotent handlers, poison messages, priority starvation, scheduler overlap across instances and graceful drain.

Test cases for real time features and websockets

Test cases28 cases on messages lost in the reconnect gap, half open connections, per channel authorisation, tokens expiring mid connection, backpressure and fanout across instances.

Test cases for file storage and media processing

Test cases28 cases on signed URL scope and expiry, serving before scanning completes, content type sniffing, metadata stripping, orphaned objects and derivative failures.

Test cases for CSV import and bulk operations

Test cases28 cases on reruns duplicating successes, delimiters inside quoted fields, byte order marks, leading zeros, ambiguous dates and bulk action scope.

Test cases for feature flags and progressive rollout

Test cases28 cases on unreachable flag services, unstable bucketing, rollouts that reshuffle users, kill switch latency, server and client mismatch and stale flags.

Test cases for Android app lifecycle and permissions

Test cases28 cases on state lost to process death, configuration changes, permanent permission denial, revocation while backgrounded, doze and battery restrictions.

Test cases for iOS app lifecycle and permissions

Test cases28 cases on the keychain surviving uninstall, suspended termination, limited photo access, allow once location, app switcher snapshots and biometric invalidation.

Test cases for wearable app sync

Test cases28 cases on data recorded away from the phone, duplicate records on resync, full buffers, clock drift, health permissions, battery budgets and unworn readings.

Test cases for VR and AR experiences

Test cases28 cases on the frame rate comfort floor, tracking loss, guardian boundaries, involuntary camera movement, AR anchor drift and spatial data privacy.

Test cases for IoT device pairing and telemetry

Test cases28 cases on offline buffering and reconnect floods, fleet wide reconnection storms, shared credentials, wrong device clocks and stale queued commands.

Test cases for embedded firmware update

Test cases28 cases on power loss mid write, automatic rollback and health confirmation, signature and anti rollback checks, staged rollouts and recovery mode.

Test cases for user profile and account settings

Test cases28 cases on partial saves reported as success, optimistic updates the server rejected, mass assignment through a profile form, avatar content inspection and session invalidation.

Test cases for account deletion and data export

Test cases28 cases on export links that must be authorised and expiring, deletion cascading to storage, caches, logs and processors, grace periods, legal holds and deadlines.

Test cases for consent and cookie management

Test cases28 cases on cookies and tracking requests firing before consent, reject parity with accept, tag manager bypass, withdrawal, cached banners and server side forwarding.

Test cases for notification preferences and delivery

Test cases28 cases on opt outs honoured on one channel and ignored on another, marketing sent as transactional, unsubscribe scope, imports resetting consent and digest timezones.

Test cases for admin impersonation and support access

Test cases28 cases on actions attributed to the customer instead of the admin, credential exposure, chained and upward impersonation, session expiry and immutable access records.

Test cases for audit logs and activity history

Test cases28 cases on forged entries through log injection, immutability and tamper detection, actor attribution across impersonation and jobs, retention and legal holds.

Sources

Want notifications reaching the right person?

QAble tests mobile apps on real devices with ISTQB-certified engineers. Start with a free QA audit of your app.

Talk to QA Advisor