View all services
Talk to QA Advisor
Browse the Knowledge Hub74 resources
/Test Cases/Real time and websocket test cases

Test cases

Websocket test cases, for the messages lost in the reconnect gap

Twenty eight cases covering messages published while disconnected, reconnect backoff and storms, half open connections, resume deduplication, socket and per channel authorisation, tokens expiring mid connection, optimistic update rollback, presence after abrupt disconnect, backpressure, fanout across instances and blocked upgrades.

28cases/8coverage types/9security cases/FreeCSV download

All 28 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

28 worked examples

RT-01

Establish a connection and receive live updates

TypeFunctionalPriorityHigh
Test data
A subscribed client receiving a published message
Expected result
Message arrives within the stated latency budget and renders correctly, and the connection state is visible to the user.
RT-02

Recover messages published during a reconnect gap

TypeStatePriorityHigh
Test data
Drop the connection, publish three messages, then reconnect
Expected result
All three are delivered on resume through a cursor or sequence number. A clean reconnect that silently skips them is the defining defect of real time features.
RT-03

Reconnect automatically with backoff

TypeStatePriorityHigh
Test data
Drop the connection repeatedly and watch the retry pattern
Expected result
Reconnection uses exponential backoff with jitter and a cap, so a server restart does not produce a synchronised reconnect storm from every client at once.
RT-04

Show connection state honestly

TypeFunctionalPriorityHigh
Test data
Disconnect and remain disconnected past the reconnect attempts
Expected result
Interface indicates that live updates have stopped. A screen that looks connected while showing stale data is worse than one that admits it is offline.
RT-05

Detect a half open connection

TypeNegativePriorityHigh
Test data
Silently drop the underlying network without a close frame
Expected result
Heartbeat or ping detects the dead connection within the stated interval, rather than the client waiting indefinitely on a socket that will never deliver.
RT-06

Deduplicate messages redelivered after resume

TypeBoundaryPriorityHigh
Test data
Resume from a cursor that overlaps messages already received
Expected result
Duplicates are recognised by message identifier and not rendered twice, since replay on resume commonly overlaps.
RT-07

Preserve message order within a channel

TypeBoundaryPriorityHigh
Test data
Publish a rapid sequence of ordered updates to one channel
Expected result
Applied in order, with a sequence number so the client can detect a gap rather than assuming arrival order is correct.
RT-08

Authenticate the socket connection itself

TypeSecurityPriorityHigh
Test data
Connect with no credential, an expired token, and a token for another account
Expected result
All refused at handshake. A socket authorised only by the page that opened it is reachable directly by anyone who knows the endpoint.
RT-09

Authorise each channel subscription

TypeSecurityPriorityHigh
Test data
Subscribe to a channel belonging to another user or tenant
Expected result
Refused per subscription rather than only at connection, since one authorised connection must not grant access to every channel on the server.
RT-10

Terminate the connection when the session ends

TypeSecurityPriorityHigh
Test data
Sign out, revoke the session, and deactivate the account while a socket is open
Expected result
Connection is closed and further messages stop in all three cases, rather than a long lived socket outliving the credential that opened it.
RT-11

Re-authorise on token expiry during a long connection

TypeBoundaryPriorityHigh
Test data
Hold a connection open past the access token lifetime
Expected result
Token is refreshed on the live connection or the socket is closed and reopened, rather than continuing indefinitely on an expired credential.
RT-12

Scope message content to the recipient

TypeSecurityPriorityHigh
Test data
A broadcast to a channel whose members have different permission levels
Expected result
Each recipient receives only fields they may see, since filtering in the client leaves the restricted data present in the transmitted payload.
RT-13

Handle two devices for the same user

TypeStatePriorityHigh
Test data
The same account connected on desktop and mobile simultaneously
Expected result
Both receive updates and remain consistent, and an action on one is reflected on the other without requiring a manual refresh.
RT-14

Reconcile an optimistic update that the server rejects

TypeStatePriorityHigh
Test data
Apply a change locally, then have the server refuse it
Expected result
Local state is rolled back and the user is told, rather than the interface keeping a change that was never persisted.
RT-15

Resolve concurrent edits from two clients

TypeBoundaryPriorityHigh
Test data
Two users editing the same field at the same instant
Expected result
Documented conflict rule is applied and both users converge on the same final state, rather than each seeing their own version indefinitely.
RT-16

Keep presence accurate after an abrupt disconnect

TypeStatePriorityMedium
Test data
Force kill a client without a clean close
Expected result
Presence clears within the stated timeout. Ghost users who never leave are the most visible symptom of missing heartbeat handling.
RT-17

Apply backpressure when a client cannot keep up

TypePerformancePriorityHigh
Test data
A slow client subscribed to a high frequency channel
Expected result
Messages are coalesced, dropped with a resync signal, or the client is disconnected. An unbounded server side buffer per client is a memory exhaustion path.
RT-18

Handle a large fanout to many subscribers

TypePerformancePriorityHigh
Test data
One message published to a channel with thousands of subscribers
Expected result
Delivered inside the latency budget for all of them, and one slow subscriber does not delay delivery to the rest.
RT-19

Survive a server restart across many clients

TypeStatePriorityHigh
Test data
Restart the socket server with a large number of connected clients
Expected result
Clients reconnect on staggered backoff and resume without loss, and the reconnect wave does not overwhelm the server on startup.
RT-20

Route correctly across multiple server instances

TypeBoundaryPriorityHigh
Test data
Two clients on the same channel connected to different instances
Expected result
Both receive every message. A message published on one instance and delivered only to clients on that instance is a common scaling defect.
RT-21

Limit connection and subscription counts

TypeSecurityPriorityMedium
Test data
A single client opening many connections and subscribing to many channels
Expected result
Limits are enforced per account with a clear close reason, so one client cannot exhaust server connection capacity.
RT-22

Validate inbound messages from the client

TypeSecurityPriorityHigh
Test data
Oversized frames, malformed payloads and unexpected message types
Expected result
Each rejected without crashing the connection handler, and size limits are enforced before the payload is parsed.
RT-23

Restrict connections by origin

TypeSecurityPriorityHigh
Test data
A handshake from an unexpected origin
Expected result
Refused. The browser same origin policy does not apply to websocket handshakes, so the origin has to be checked on the server explicitly.
RT-24

Fall back when websockets are blocked

TypeCompatibilityPriorityHigh
Test data
A corporate proxy or network that blocks the websocket upgrade
Expected result
Falls back to a supported transport or degrades to polling with a clear indication, rather than showing a permanently empty live view.
RT-25

Handle backgrounding on mobile

TypeStatePriorityHigh
Test data
Background the app for several minutes, then return
Expected result
Connection is re-established on resume and missed messages are recovered, since mobile platforms suspend sockets aggressively.
RT-26

Clean up subscriptions when a view is closed

TypeStatePriorityMedium
Test data
Navigate between views repeatedly within a single page application
Expected result
Old subscriptions and listeners are removed, so messages are not handled multiple times and memory does not grow with navigation.
RT-27

Recover from a message the client cannot process

TypeNegativePriorityMedium
Test data
Publish a message with an unknown type or an unexpected field
Expected result
Ignored safely with a logged warning rather than throwing and tearing down the connection for every subsequent message.
RT-28

Operate a live updating view with a screen reader

TypeAccessibilityPriorityHigh
Test data
Incoming updates while a screen reader is active and while focus is inside a form
Expected result
Updates are announced at an appropriate urgency without stealing focus, and a live update never moves the control the user is currently interacting with.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based. Anything that silently loses messages, shows one user another channel data, or leaves the interface confidently displaying stale state is High. Reconnect behaviour is the highest value area in the set.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Publish while the client is disconnected

A message arriving over a healthy socket is the one path everyone checks. These four conditions are where real time features go quietly stale.

Drop, publish three, reconnect

A clean reconnect that skips those three is the defining defect here. Nothing errors, the interface says connected, and the user is looking at state that is wrong.

Cut the network without a close frame

A half open socket will wait forever for messages that will never come. Only a heartbeat detects it, and without one the page looks live and is dead.

Connect straight to the socket endpoint

Skip the page entirely. A socket authorised only by the page that opened it, or authorised once rather than per channel, hands over every channel on the server.

Restart the server under load

Every client reconnects at once. Without staggered backoff the reconnect wave takes the server down again immediately after it comes up.

What Most Sets Miss

Why real time features go stale

The reconnect gap is the defect worth building this set around. A socket drops, the client reconnects within a few seconds, and everything published during that window is gone. There is no error, no retry and no indication: the interface reports itself connected and displays state that is simply wrong. Fixing it requires a cursor or sequence number so the client can ask for what it missed, and testing it requires deliberately publishing while disconnected rather than testing on a stable connection where the gap never opens.

Connection state has to be honest for the same reason. A screen showing stale data while looking live is worse than one that admits it is offline, because the user has no reason to refresh. That in turn depends on detecting a half open connection, where the network has gone away without a close frame and the socket will wait indefinitely for messages that will never arrive. Only a heartbeat surfaces it.

Authorisation on sockets is commonly weaker than on the equivalent HTTP endpoints, because the socket feels like an internal detail of a page that already authenticated. It is not: the endpoint is directly reachable, so the handshake needs its own credential check and each channel subscription needs its own authorisation. Two related cases follow. A long lived connection outlives the access token that opened it, so expiry has to be handled on the live socket. And signing out, revoking a session or deactivating an account has to close the socket, otherwise the connection outlives the credential entirely.

Finally, scale changes the failure modes. Two clients on the same channel connected to different server instances must both receive every message, which requires a shared backplane and is the most common defect that appears only after horizontal scaling. A slow client needs backpressure, because an unbounded per client buffer is a memory exhaustion path. And a server restart produces a synchronised reconnect wave from every client at once, which will take the server down again unless the backoff has jitter.

Suggest an improvement

Testing a real time or collaborative product?

QAble tests live features end to end, including reconnect and resume correctness, socket authorisation, fanout across instances and behaviour under connection churn.

Scalability testing services

More test case sets

View all

Test cases for a login page

Test cases
25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for a registration form

Test cases
28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.

Test cases for search functionality

Test cases
28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases
27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases
30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases
28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for forgot password

Test cases
26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.

Test cases for OTP verification

Test cases
26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.

Test cases for user roles and permissions

Test cases
26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for form validation

Test cases
27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.

Test cases for a date picker

Test cases
26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases
24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for push notifications

Test cases
26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.

Test cases for reports and data export

Test cases
25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.

Test cases for a chatbot

Test cases
28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases
28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases
28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases
28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases
28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases
28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases
28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases
28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases
28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases
28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases
28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for subscription and billing

Test cases
28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.

Test cases for data tables, filters and sorting

Test cases
28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases
28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases
28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases
28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases
28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases
28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases
28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases
28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for performance and load

Test cases
28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.

Test cases for the OWASP Top 10

Test cases
28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases
28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases
28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases
28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Test cases for outbound webhooks

Test cases
28 cases on retry backoff and dead letter stores, one dead consumer degrading the pipeline, payload signing and replay windows, out of order delivery and endpoint SSRF.

Test cases for background jobs and queues

Test cases
28 cases on work outliving the visibility timeout, idempotent handlers, poison messages, priority starvation, scheduler overlap across instances and graceful drain.

Test cases for file storage and media processing

Test cases
28 cases on signed URL scope and expiry, serving before scanning completes, content type sniffing, metadata stripping, orphaned objects and derivative failures.

Test cases for CSV import and bulk operations

Test cases
28 cases on reruns duplicating successes, delimiters inside quoted fields, byte order marks, leading zeros, ambiguous dates and bulk action scope.

Test cases for feature flags and progressive rollout

Test cases
28 cases on unreachable flag services, unstable bucketing, rollouts that reshuffle users, kill switch latency, server and client mismatch and stale flags.

Test cases for Android app lifecycle and permissions

Test cases
28 cases on state lost to process death, configuration changes, permanent permission denial, revocation while backgrounded, doze and battery restrictions.

Test cases for iOS app lifecycle and permissions

Test cases
28 cases on the keychain surviving uninstall, suspended termination, limited photo access, allow once location, app switcher snapshots and biometric invalidation.

Test cases for wearable app sync

Test cases
28 cases on data recorded away from the phone, duplicate records on resync, full buffers, clock drift, health permissions, battery budgets and unworn readings.

Test cases for VR and AR experiences

Test cases
28 cases on the frame rate comfort floor, tracking loss, guardian boundaries, involuntary camera movement, AR anchor drift and spatial data privacy.

Test cases for IoT device pairing and telemetry

Test cases
28 cases on offline buffering and reconnect floods, fleet wide reconnection storms, shared credentials, wrong device clocks and stale queued commands.

Test cases for embedded firmware update

Test cases
28 cases on power loss mid write, automatic rollback and health confirmation, signature and anti rollback checks, staged rollouts and recovery mode.

Test cases for user profile and account settings

Test cases
28 cases on partial saves reported as success, optimistic updates the server rejected, mass assignment through a profile form, avatar content inspection and session invalidation.

Test cases for account deletion and data export

Test cases
28 cases on export links that must be authorised and expiring, deletion cascading to storage, caches, logs and processors, grace periods, legal holds and deadlines.

Test cases for consent and cookie management

Test cases
28 cases on cookies and tracking requests firing before consent, reject parity with accept, tag manager bypass, withdrawal, cached banners and server side forwarding.

Test cases for notification preferences and delivery

Test cases
28 cases on opt outs honoured on one channel and ignored on another, marketing sent as transactional, unsubscribe scope, imports resetting consent and digest timezones.

Test cases for admin impersonation and support access

Test cases
28 cases on actions attributed to the customer instead of the admin, credential exposure, chained and upward impersonation, session expiry and immutable access records.

Test cases for audit logs and activity history

Test cases
28 cases on forged entries through log injection, immutability and tamper detection, actor attribution across impersonation and jobs, retention and legal holds.

Want your live updates proven, not assumed?

QAble covers functional, state and performance paths with ISTQB-certified engineers. Start with a free QA audit of your platform.

Talk to QA Advisor