SeleniumLab

Course → 3 · Professional QA engineering → Security Testing Basics

3 · Professional QA engineering

Auth, sessions, and authorization

18 min · Module 19

Verify authentication (who you are) and authorization (what you may access). Test horizontal privilege issues (user A sees user B tickets).

Lab: call /lab/api/tickets/ logged out vs logged in; create as user A and ensure B cannot fetch A’s id if isolation is enforced.

Example / notes

import requests
r = requests.get("http://127.0.0.1:8000/lab/api/tickets/")
# Expect 401/302/403 when anonymous — not another user's data

Practice in Lab: /lab/api/tickets/

Log in to track progress / take quizzes

OWASP-minded checks for web apps →

Modules in this track

15. QA Foundations — Strategy & Planning
- Writing a test strategy
- Test planning and estimation
16. Test Design Techniques
17. API & Contract Testing
- HTTP API testing fundamentals
- Contract and schema testing
18. Performance Testing Basics
- Performance concepts and SLOs
- Designing a minimal performance check
19. Security Testing Basics
- Auth, sessions, and authorization
- OWASP-minded checks for web apps
20. Accessibility Testing
- Accessible by design checks
- Automated a11y smoke
21. Mobile Testing
- Mobile web quality risks
- Native apps and device farms (overview)
22. CI/CD, Quality Gates & Environments
- Pipelines and quality gates
- Environments and progressive delivery
23. Test Data, Environments & Observability
- Test data management
- Observability for QA
24. Soft Skills — Stakeholders, Mentoring, Metrics
- Stakeholder communication
- Mentoring and quality metrics/OKRs
25. Career & Process — Agile, Compliance, Senior Bar