Selenium Security & Authentication 2

Question 1

When testing OAuth 2.0 flows with Selenium, what is the recommended approach for handling the authorization code exchange?

Accepted Answer

Use a pre-obtained access token injected via API to skip the browser UI

Answer

Injecting a pre-obtained token via API bypasses flaky redirect flows and keeps tests focused on application behavior rather than the auth provider.

Question 2

A Selenium test must verify that a page sets the HttpOnly flag on session cookies. Which approach correctly inspects this?

Accepted Answer

Use driver.manage().getCookieNamed() and inspect the isHttpOnly property

Answer

WebDriver's Cookie object exposes isHttpOnly(), allowing direct programmatic assertion without needing a proxy.

Question 3

What does the SameSite=Strict cookie attribute mean, and how would you verify it in a Selenium test?

Accepted Answer

Cookie is never sent on cross-site requests; verify using driver.manage().getCookieNamed() and check sameSite property

Answer

SameSite=Strict prevents the cookie from being sent on any cross-origin request, and Selenium's Cookie object includes the sameSite attribute.

Question 4

While automating a login page, your Selenium test encounters a CAPTCHA. What is the best practice for handling it in CI pipelines?

Accepted Answer

Whitelist the test environment IP or use a CAPTCHA bypass token provided by the dev team

Answer

Whitelisting test IPs or using bypass tokens is the sanctioned approach that avoids circumventing security controls inappropriately.

Question 5

Which Selenium capability allows you to configure a browser to trust a self-signed certificate during security testing?

Accepted Answer

Setting acceptInsecureCerts to true in DesiredCapabilities or browser Options

Answer

acceptInsecureCerts: true in the browser options instructs WebDriver to bypass certificate validation errors for self-signed certs.

(Selenium) Selenium Testing Certification Practice Test