I
got a copy of Testing ASP.NET Web
Applications
a while ago but it’s taken me some time to get through it because I
wanted to dedicate the time and attention to it that it needed. There
really aren’t many decent books that discuss testing all different
aspects of web applications (though there are several dedicated
specifically to security testing). The content in this book is something
I’ve been trying to find for a long time in a format aggregated all
together in one place and, despite a few rough edges, I’ll be
recommending it to my QA friends this year.
I’ll run down the content chapter by chapter so you can see what’s
inside and decide for yourself.
Chapter 1: Preliminary Concerns
The first chapter gives a nice, concise history of testing tools
starting from sUnit (Smalltalk unit testing) and bringing us through
today, so you can see where we’ve been. It also provides a really nice
terminology list. I may have to blow the terminology list up and attach
it to my wall so I can point to it and make sure in discussions that
everyone’s on the same page, talking about the same thing. Finally,
there’s a good test-related “mythbusters” section you can use to get
testing moving forward in your organization.
Chapter 2: Design and Testability
This chapter starts off with a summary overview of what makes a good
unit test. I agreed with some points and disagreed with others, but the
qualities that “make a good unit test” are sort of a religious debate
that people can’t agree on - for example, naming conventions. That said,
they revisit what makes a good unit test at the end with a checklist of
sorts that is really good. They talk about the design of your code and
how it affects testability, discussing the SOLID design principles, and
test smells (fragile tests, slow tests, etc.) you might encounter. They
do touch lightly on pair programming and test driven development in this
chapter (saving the details for the next chapter) but they don’t discuss
it in a dogmatic way, which is a nice change from most articles you’ll
read on the subject.
There is a section on refactoring in chapter 2 that felt somewhat out of
place, like they wanted to relate the refactoring examples to how easy
refactoring can be if you design your code well, but it really felt
bolted on and distracting.
Chapter 3: Unit Testing and Test Driven Development
The chapter on unit testing and TDD should have been one of the best
chapters, but it wasn’t as helpful as I’d hoped it would be. Since this
is an ASP.NET specific book, the aim of the chapter should have been to
explain how to get testing running in ASP.NET - web forms and MVC. Of
the 50 pages in the chapter, about two talk about web forms and the
model-view-presenter way of separating concerns and getting web forms
testable. The rest of the time is spent on ASP.NET MVC and setting up an
example application that gets used through the rest of the book. While I
agree with the authors that MVC is a far more testable framework, that
doesn’t help the people who have legacy applications or who are
otherwise stuck on web forms. There is a tiny bit at the end that
basically says, “It’s not worth much to try retrofitting unit tests to
web forms” (without saying those exact words). I feel like there was a
huge opportunity missed.
As for MVC, the authors suggest a different “default project structure”
than the one provided by ASP.NET MVC out of the box, and I only
partially agree with the proposal. The idea is sound, but it would be
nice to see things in a stock fashion since a new project structure
really only applies to Greenfield work.
The walkthrough of creating the demo application is very valuable and
shows the red/green/refactor process of test driven development well. If
you’re unfamiliar with this process, it’s good to see it. Of course,
they also introduce a lot of patterns and concepts very quickly with
little ceremony (e.g., the repository pattern, NHibernate usage, etc.)
and that’s a lot to take in, so be patient.
Chapter 4: Integration Testing
This chapter is a pretty short chapter and talks about the differences
between unit testing and integration testing, then runs through adding
some integration tests to the sample application so you can get a feel
for doing that.
Chapter 5: Automated User Interface Testing
This chapter breaks down the different types of functional testing and
talks about the benefits, drawbacks, and challenges of automating the
UI. The discussion of challenges is really good, listing different ways
your UI automation tests can fail. It definitely gives you something to
think about as you head down this road.
They break down different tools and approaches to UI testing with a
primary focus on WatiN, Visual Studio Web Tests, and Selenium usage.
They then show how to apply these tools to automating the sample
application so you can see them in action. (There is also a section on
qUnit - unit testing for JavaScript - at the end of the chapter, but
it’s really thin and feels like an afterthought.)
During the automation of the sample app, there is a little bit of
distraction as the authors get a little lost in the weeds introducing
test data generators with fluent interfaces right in the middle. For
automated UI testing you do need some test data to populate the system
with, but it’s really confusing and distracting plopped right in the
middle of everything.
Chapter 6: Acceptance Testing
The chapter on acceptance testing starts off with some good terminology,
but then dives into Scrum project management methodology. It feels like
they’re taking you on a ride, but if you have a little faith, you’ll see
how they bring you back around to testing. It’s a worthwhile detour,
even if it feels a little abrupt.
They focus on FitNesse and Cucumber as the two acceptance testing
frameworks and show you how to get each running. I read the FitNesse
section twice and still didn’t really get it. There were lots of wiki
screen shots and tiny code snippets, but nothing that was complete
enough. It took skipping forward to the example section and once I got
it, I started questioning if the work involved was really worth it. On
the other hand, Cucumber seemed reasonably straightforward (though it,
too, didn’t come clear until seeing a real example rather than just
reading about it in hypothetical terms).
I’m not sure the acceptance testing chapter accomplished for me what it
set out to. After seeing all of the work and “glue code” required to get
the business users the ability to write tests, I wondered if it might be
time better spent getting them to write use case documents and having
the developers write WatiN tests to associate with those documents. (Of
course, in thinking that, maybe I missed the point.)
Chapter 7: Manual Testing
This chapter talks about the things to look for in manual testing -
usability, documentation, error messages - as well as scenarios you
might look for - session timeouts, disconnected/down services, network
issues, etc. It provides a few tools that can help you in manual testing
and explains how to document manual test cases. It’s not a long chapter,
but it’s nice to formalize some of this stuff, or at least give teams a
place to start discussing. “Manual testing” isn’t just “jump in and
start clicking buttons.”
Chapter 8: Performance Testing
Of all the chapters in the book, this one was my favorite. It starts
off by giving a high-level description of what performance testing is
and then it dives right in. There is some great guidance on establishing
baselines and expectations as well as capturing requirements. It gives
you a lot to think about and discuss with your customers around
performance and gives a good set of questions to ask about it.
They provide a great list of tools you can use to measure performance
and shows a sample run of each one. I was really happy with this bit
because it was like having someone evaluate all of these tools for you,
show you the outputs, and help you decide which one you like best.
Really helpful.
They outline the components of a performance test environment and
explain some of the relevant performance counters you should watch when
running tests and what they mean.
Finally, they correlate performance testing with capacity planning so
you can take the numbers you record and start figuring out what kind of
resources you’ll need to address your site’s target audience.
Chapter 9: Accessibility Testing
Right after the chapter on performance testing, this was my next
favorite chapter. There’s a nice “accessibility mythbusters” section to
disprove common misconceptions about accessibility and the web and a
good discussion about the benefits of making your site accessible.
One of the nice bits about this chapter is that they take the time to
discuss a few of the disabilities that people visiting your site might
have and then provide simulated screen shots showing what users with
these disabilities might be seeing. (Granted, the book is printed in
black and white so the screen shots showing “color blindness” are less
than effective, but the rest are good.)
They talk about several things you might see in web sites - images,
graphs, forms, lists - and how to make them accessible. They also talk
about other things to look for like acronym usage and CAPTCHA and how
those aren’t accessible. While they touch briefly on audio/visual media,
not much help is offered beyond descriptions of what you could possibly
do (not how to do it). Same thing with JavaScript - they talk a bit
about what to do and what not to do, but don’t really show any examples.
There is a great list of links to different web accessibility standards,
not just for the US but for countries around the world. There’s also a
good list of tools you can use to help you test your site’s
accessibility and they do a bit of a walkthrough using these tools to
test their sample web site.
Chapter 10: Security Testing
This chapter starts out explaining some common security terminology and
then dives into selling you the benefits of security testing. It’s
unfortunate that anyone should have to be convinced to test their app
for security, but if you have to get some time allocated from
management, this is a decent list of things you can discuss.
Just like in the accessibility testing chapter, there is a list of links
to related standards for security and compliance here as well as a list
of places to go (like OWASP) for some guidance.
The bulk of the chapter focuses on the OWASP Top 10 vulnerabilities and
walks you through an example of testing for each. This is the most
valuable part of the chapter and if you’ve ever heard of, say, “SQL
injection” but you’re not sure what it looks like, this is really good.
There is a section about how to assess and report vulnerabilities in
your application which is really good for communicating risk and helping
manage that for your project.
Finally, there’s a list of security-related testing tools… but there
isn’t really a description of them or any example usage, just a list of
URL links. This felt like a bit of missed opportunity here, or maybe a
last-minute addition.
General Thoughts
There were a ton of spelling and grammar mistakes through the book,
enough that it was a little distracting. I sort of wondered if the
editor was asleep at the wheel. It didn’t make the book unreadable, but
it does feel like a bump in an otherwise reasonably smooth ride.
Also, while many of the topics were really good, there were things I
felt that belonged but were jammed in the wrong spots. For example, the
discussion about design patterns that gets stuck in the middle of the
TDD chapter may have felt better in the chapter before it about design.
Finally, there were lots of good tool lists, good links to related
sites… it’d have been nice to see those recapped in appendices at the
end so you don’t have to hunt them down later in the middle of the book.
In the end? Recommended.
Despite some of the rough edges, I haven’t seen a book before that
captures all of this information in one place. I know it’s earned a
place on my shelf. If you’re looking for a book on testing ASP.NET web
apps, this is one to consider.
