Browse the Knowledge Hub74 resources
Test cases
Websocket test cases, for the messages lost in the reconnect gap
Twenty eight cases covering messages published while disconnected, reconnect backoff and storms, half open connections, resume deduplication, socket and per channel authorisation, tokens expiring mid connection, optimistic update rollback, presence after abrupt disconnect, backpressure, fanout across instances and blocked upgrades.
All 28 test cases, ready to copy
Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.
Last updated
28 worked examples
Establish a connection and receive live updates
TypeFunctionalPriorityHigh- Test data
- A subscribed client receiving a published message
- Expected result
- Message arrives within the stated latency budget and renders correctly, and the connection state is visible to the user.
Recover messages published during a reconnect gap
TypeStatePriorityHigh- Test data
- Drop the connection, publish three messages, then reconnect
- Expected result
- All three are delivered on resume through a cursor or sequence number. A clean reconnect that silently skips them is the defining defect of real time features.
Reconnect automatically with backoff
TypeStatePriorityHigh- Test data
- Drop the connection repeatedly and watch the retry pattern
- Expected result
- Reconnection uses exponential backoff with jitter and a cap, so a server restart does not produce a synchronised reconnect storm from every client at once.
Show connection state honestly
TypeFunctionalPriorityHigh- Test data
- Disconnect and remain disconnected past the reconnect attempts
- Expected result
- Interface indicates that live updates have stopped. A screen that looks connected while showing stale data is worse than one that admits it is offline.
Detect a half open connection
TypeNegativePriorityHigh- Test data
- Silently drop the underlying network without a close frame
- Expected result
- Heartbeat or ping detects the dead connection within the stated interval, rather than the client waiting indefinitely on a socket that will never deliver.
Deduplicate messages redelivered after resume
TypeBoundaryPriorityHigh- Test data
- Resume from a cursor that overlaps messages already received
- Expected result
- Duplicates are recognised by message identifier and not rendered twice, since replay on resume commonly overlaps.
Preserve message order within a channel
TypeBoundaryPriorityHigh- Test data
- Publish a rapid sequence of ordered updates to one channel
- Expected result
- Applied in order, with a sequence number so the client can detect a gap rather than assuming arrival order is correct.
Authenticate the socket connection itself
TypeSecurityPriorityHigh- Test data
- Connect with no credential, an expired token, and a token for another account
- Expected result
- All refused at handshake. A socket authorised only by the page that opened it is reachable directly by anyone who knows the endpoint.
Authorise each channel subscription
TypeSecurityPriorityHigh- Test data
- Subscribe to a channel belonging to another user or tenant
- Expected result
- Refused per subscription rather than only at connection, since one authorised connection must not grant access to every channel on the server.
Terminate the connection when the session ends
TypeSecurityPriorityHigh- Test data
- Sign out, revoke the session, and deactivate the account while a socket is open
- Expected result
- Connection is closed and further messages stop in all three cases, rather than a long lived socket outliving the credential that opened it.
Re-authorise on token expiry during a long connection
TypeBoundaryPriorityHigh- Test data
- Hold a connection open past the access token lifetime
- Expected result
- Token is refreshed on the live connection or the socket is closed and reopened, rather than continuing indefinitely on an expired credential.
Scope message content to the recipient
TypeSecurityPriorityHigh- Test data
- A broadcast to a channel whose members have different permission levels
- Expected result
- Each recipient receives only fields they may see, since filtering in the client leaves the restricted data present in the transmitted payload.
Handle two devices for the same user
TypeStatePriorityHigh- Test data
- The same account connected on desktop and mobile simultaneously
- Expected result
- Both receive updates and remain consistent, and an action on one is reflected on the other without requiring a manual refresh.
Reconcile an optimistic update that the server rejects
TypeStatePriorityHigh- Test data
- Apply a change locally, then have the server refuse it
- Expected result
- Local state is rolled back and the user is told, rather than the interface keeping a change that was never persisted.
Resolve concurrent edits from two clients
TypeBoundaryPriorityHigh- Test data
- Two users editing the same field at the same instant
- Expected result
- Documented conflict rule is applied and both users converge on the same final state, rather than each seeing their own version indefinitely.
Keep presence accurate after an abrupt disconnect
TypeStatePriorityMedium- Test data
- Force kill a client without a clean close
- Expected result
- Presence clears within the stated timeout. Ghost users who never leave are the most visible symptom of missing heartbeat handling.
Apply backpressure when a client cannot keep up
TypePerformancePriorityHigh- Test data
- A slow client subscribed to a high frequency channel
- Expected result
- Messages are coalesced, dropped with a resync signal, or the client is disconnected. An unbounded server side buffer per client is a memory exhaustion path.
Handle a large fanout to many subscribers
TypePerformancePriorityHigh- Test data
- One message published to a channel with thousands of subscribers
- Expected result
- Delivered inside the latency budget for all of them, and one slow subscriber does not delay delivery to the rest.
Survive a server restart across many clients
TypeStatePriorityHigh- Test data
- Restart the socket server with a large number of connected clients
- Expected result
- Clients reconnect on staggered backoff and resume without loss, and the reconnect wave does not overwhelm the server on startup.
Route correctly across multiple server instances
TypeBoundaryPriorityHigh- Test data
- Two clients on the same channel connected to different instances
- Expected result
- Both receive every message. A message published on one instance and delivered only to clients on that instance is a common scaling defect.
Limit connection and subscription counts
TypeSecurityPriorityMedium- Test data
- A single client opening many connections and subscribing to many channels
- Expected result
- Limits are enforced per account with a clear close reason, so one client cannot exhaust server connection capacity.
Validate inbound messages from the client
TypeSecurityPriorityHigh- Test data
- Oversized frames, malformed payloads and unexpected message types
- Expected result
- Each rejected without crashing the connection handler, and size limits are enforced before the payload is parsed.
Restrict connections by origin
TypeSecurityPriorityHigh- Test data
- A handshake from an unexpected origin
- Expected result
- Refused. The browser same origin policy does not apply to websocket handshakes, so the origin has to be checked on the server explicitly.
Fall back when websockets are blocked
TypeCompatibilityPriorityHigh- Test data
- A corporate proxy or network that blocks the websocket upgrade
- Expected result
- Falls back to a supported transport or degrades to polling with a clear indication, rather than showing a permanently empty live view.
Handle backgrounding on mobile
TypeStatePriorityHigh- Test data
- Background the app for several minutes, then return
- Expected result
- Connection is re-established on resume and missed messages are recovered, since mobile platforms suspend sockets aggressively.
Clean up subscriptions when a view is closed
TypeStatePriorityMedium- Test data
- Navigate between views repeatedly within a single page application
- Expected result
- Old subscriptions and listeners are removed, so messages are not handled multiple times and memory does not grow with navigation.
Recover from a message the client cannot process
TypeNegativePriorityMedium- Test data
- Publish a message with an unknown type or an unexpected field
- Expected result
- Ignored safely with a logged warning rather than throwing and tearing down the connection for every subsequent message.
Operate a live updating view with a screen reader
TypeAccessibilityPriorityHigh- Test data
- Incoming updates while a screen reader is active and while focus is inside a form
- Expected result
- Updates are announced at an appropriate urgency without stealing focus, and a live update never moves the control the user is currently interacting with.
What goes in each field
ID
RequiredStable identifier, prefixed by module.
Test case
RequiredWhat is being verified, in one line.
Type
Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.
Priority
Risk based. Anything that silently loses messages, shows one user another channel data, or leaves the interface confidently displaying stale state is High. Reconnect behaviour is the highest value area in the set.
Test data
The specific values, including the invalid and boundary ones.
Expected result
RequiredThe precise observable outcome, including message text where the wording itself is the requirement.
Publish while the client is disconnected
A message arriving over a healthy socket is the one path everyone checks. These four conditions are where real time features go quietly stale.
Drop, publish three, reconnect
A clean reconnect that skips those three is the defining defect here. Nothing errors, the interface says connected, and the user is looking at state that is wrong.
Cut the network without a close frame
A half open socket will wait forever for messages that will never come. Only a heartbeat detects it, and without one the page looks live and is dead.
Connect straight to the socket endpoint
Skip the page entirely. A socket authorised only by the page that opened it, or authorised once rather than per channel, hands over every channel on the server.
Restart the server under load
Every client reconnects at once. Without staggered backoff the reconnect wave takes the server down again immediately after it comes up.
Why real time features go stale
The reconnect gap is the defect worth building this set around. A socket drops, the client reconnects within a few seconds, and everything published during that window is gone. There is no error, no retry and no indication: the interface reports itself connected and displays state that is simply wrong. Fixing it requires a cursor or sequence number so the client can ask for what it missed, and testing it requires deliberately publishing while disconnected rather than testing on a stable connection where the gap never opens.
Connection state has to be honest for the same reason. A screen showing stale data while looking live is worse than one that admits it is offline, because the user has no reason to refresh. That in turn depends on detecting a half open connection, where the network has gone away without a close frame and the socket will wait indefinitely for messages that will never arrive. Only a heartbeat surfaces it.
Authorisation on sockets is commonly weaker than on the equivalent HTTP endpoints, because the socket feels like an internal detail of a page that already authenticated. It is not: the endpoint is directly reachable, so the handshake needs its own credential check and each channel subscription needs its own authorisation. Two related cases follow. A long lived connection outlives the access token that opened it, so expiry has to be handled on the live socket. And signing out, revoking a session or deactivating an account has to close the socket, otherwise the connection outlives the credential entirely.
Finally, scale changes the failure modes. Two clients on the same channel connected to different server instances must both receive every message, which requires a shared backplane and is the most common defect that appears only after horizontal scaling. A slow client needs backpressure, because an unbounded per client buffer is a memory exhaustion path. And a server restart produces a synchronised reconnect wave from every client at once, which will take the server down again unless the backoff has jitter.
Suggest an improvementTesting a real time or collaborative product?
QAble tests live features end to end, including reconnect and resume correctness, socket authorisation, fanout across instances and behaviour under connection churn.
Scalability testing servicesMore test case sets
View allTest cases for a login page
Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.Test cases for a registration form
Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.Test cases for search functionality
Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.Test cases for a shopping cart
Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.Test cases for checkout and payment
Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.Test cases for file upload
Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.Test cases for forgot password
Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.Test cases for OTP verification
Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.Test cases for user roles and permissions
Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.Test cases for form validation
Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.Test cases for a date picker
Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.Test cases for pagination
Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.Test cases for push notifications
Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.Test cases for reports and data export
Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.Test cases for a chatbot
Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.Test cases for net banking transactions
Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.Test cases for wallet and UPI payments
Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.Test cases for insurance claim submission
Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.Test cases for patient records in an EHR
Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.Test cases for CRM lead management
Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.Test cases for an ERP purchase order
Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.Test cases for OTT video playback
Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.Test cases for game level progression
Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.Test cases for a REST API
Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.Test cases for SSO and social login
Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.Test cases for subscription and billing
Test cases28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.Test cases for data tables, filters and sorting
Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.Test cases for session timeout and concurrent login
Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.Test cases for a multi step form wizard
Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.Test cases for email verification
Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.Test cases for dashboards and analytics widgets
Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.Test cases for booking and reservation
Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.Test cases for mobile app install and update
Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.Test cases for accessibility (WCAG 2.2 AA)
Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.Test cases for performance and load
Test cases28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.Test cases for the OWASP Top 10
Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.Test cases for cross browser compatibility
Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.Test cases for database and data integrity
Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.Test cases for localisation and multi language support
Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.Test cases for outbound webhooks
Test cases28 cases on retry backoff and dead letter stores, one dead consumer degrading the pipeline, payload signing and replay windows, out of order delivery and endpoint SSRF.Test cases for background jobs and queues
Test cases28 cases on work outliving the visibility timeout, idempotent handlers, poison messages, priority starvation, scheduler overlap across instances and graceful drain.Test cases for file storage and media processing
Test cases28 cases on signed URL scope and expiry, serving before scanning completes, content type sniffing, metadata stripping, orphaned objects and derivative failures.Test cases for CSV import and bulk operations
Test cases28 cases on reruns duplicating successes, delimiters inside quoted fields, byte order marks, leading zeros, ambiguous dates and bulk action scope.Test cases for feature flags and progressive rollout
Test cases28 cases on unreachable flag services, unstable bucketing, rollouts that reshuffle users, kill switch latency, server and client mismatch and stale flags.Test cases for Android app lifecycle and permissions
Test cases28 cases on state lost to process death, configuration changes, permanent permission denial, revocation while backgrounded, doze and battery restrictions.Test cases for iOS app lifecycle and permissions
Test cases28 cases on the keychain surviving uninstall, suspended termination, limited photo access, allow once location, app switcher snapshots and biometric invalidation.Test cases for wearable app sync
Test cases28 cases on data recorded away from the phone, duplicate records on resync, full buffers, clock drift, health permissions, battery budgets and unworn readings.Test cases for VR and AR experiences
Test cases28 cases on the frame rate comfort floor, tracking loss, guardian boundaries, involuntary camera movement, AR anchor drift and spatial data privacy.Test cases for IoT device pairing and telemetry
Test cases28 cases on offline buffering and reconnect floods, fleet wide reconnection storms, shared credentials, wrong device clocks and stale queued commands.Test cases for embedded firmware update
Test cases28 cases on power loss mid write, automatic rollback and health confirmation, signature and anti rollback checks, staged rollouts and recovery mode.Test cases for user profile and account settings
Test cases28 cases on partial saves reported as success, optimistic updates the server rejected, mass assignment through a profile form, avatar content inspection and session invalidation.Test cases for account deletion and data export
Test cases28 cases on export links that must be authorised and expiring, deletion cascading to storage, caches, logs and processors, grace periods, legal holds and deadlines.Test cases for consent and cookie management
Test cases28 cases on cookies and tracking requests firing before consent, reject parity with accept, tag manager bypass, withdrawal, cached banners and server side forwarding.Test cases for notification preferences and delivery
Test cases28 cases on opt outs honoured on one channel and ignored on another, marketing sent as transactional, unsubscribe scope, imports resetting consent and digest timezones.Test cases for admin impersonation and support access
Test cases28 cases on actions attributed to the customer instead of the admin, credential exposure, chained and upward impersonation, session expiry and immutable access records.Test cases for audit logs and activity history
Test cases28 cases on forged entries through log injection, immutability and tamper detection, actor attribution across impersonation and jobs, retention and legal holds.Want your live updates proven, not assumed?
QAble covers functional, state and performance paths with ISTQB-certified engineers. Start with a free QA audit of your platform.