Selenium Security & Authentication 3 — Questions and Answers
Question 1: When automating tests for a multi-factor authentication (MFA) flow, what strategy minimizes test fragility?
- Automate reading SMS codes in real time using a telephony API or test phone number service
- Disable MFA entirely in the test environment and document the gap
- Hardcode a fixed OTP that never expires
- Mock the MFA provider at the network layer to return a predictable code (Correct answer)
Correct answer: Mock the MFA provider at the network layer to return a predictable code
Mocking the MFA provider at the network or service layer returns a deterministic code, making tests reliable without depending on external SMS or TOTP timing.
Question 2: Which Selenium approach correctly validates that a logout action invalidates a user session on the server side?
- Confirm the browser redirects to the login page after logout
- After logout, attempt an API call with the old session token and assert it returns a 401 response (Correct answer)
- Check that all cookies are cleared in document.cookie after logout
- Verify the browser history no longer contains the authenticated URL
Correct answer: After logout, attempt an API call with the old session token and assert it returns a 401 response
Validating the server-side session via an API call with the old token is the only reliable way to confirm the session was truly invalidated.
Question 3: A Selenium test needs to verify that a web form is protected against SQL injection. What is the correct testing approach?
- Submit SQL payloads like ' OR '1'='1 through form fields and assert the application returns an error rather than data (Correct answer)
- Use WebDriver's executeScript to directly query the database
- Check that input fields have a maxlength HTML attribute
- Confirm the form uses POST instead of GET
Correct answer: Submit SQL payloads like ' OR '1'='1 through form fields and assert the application returns an error rather than data
Submitting known SQL injection payloads via the UI and asserting a safe error response (not data leakage) validates input sanitization end-to-end.
Question 4: How should a Selenium framework securely pass credentials to browser-based login flows in a CI/CD environment?
- Read credentials from environment variables or a secrets manager at runtime (Correct answer)
- Embed credentials in the test class as private static fields
- Pass credentials as JVM or CLI arguments visible in the process list
- Store credentials in a JSON config file tracked in git
Correct answer: Read credentials from environment variables or a secrets manager at runtime
Environment variables or secrets managers (Vault, AWS Secrets Manager, CI secrets) prevent credentials from appearing in code or process listings.
Question 5: During a Selenium test, you detect that an application reflects user input directly in the page without encoding. Which vulnerability does this indicate?
- SQL Injection
- Cross-Site Scripting (XSS) (Correct answer)
- CSRF
- Clickjacking
Correct answer: Cross-Site Scripting (XSS)
Unencoded reflection of user-controlled input in HTML output is the classic definition of a reflected XSS vulnerability.
Question 6: What is the purpose of testing for the X-Frame-Options response header in a Selenium security test?
- To verify that images load correctly in frames
- To confirm the site is protected against clickjacking attacks (Correct answer)
- To check that iframes are disabled in the browser
- To validate that cross-origin requests are blocked
Correct answer: To confirm the site is protected against clickjacking attacks
X-Frame-Options: DENY or SAMEORIGIN prevents the page from being embedded in an iframe, which is the attack vector for clickjacking.
Question 7: When using Selenium Grid in a corporate network, which security measure is most critical to implement first?
- Enable authentication on the Grid Hub endpoint to prevent unauthorized node registration and job submission (Correct answer)
- Switch all nodes to use Chrome instead of Firefox
- Increase session timeout to 24 hours
- Run the Grid Hub on localhost only
Correct answer: Enable authentication on the Grid Hub endpoint to prevent unauthorized node registration and job submission
An unauthenticated Grid Hub allows any actor on the network to submit arbitrary browser sessions and potentially exfiltrate data or execute malicious scripts.
Selenium Security & Authentication 3
When automating tests for a multi-factor authentication (MFA) flow, what strategy minimizes test fragility?