WebSockets keep a two-way connection open so client and server can exchange messages. Test the connection lifecycle as well as message content.
On this guide
Connection
- Successful handshake returns
101 Switching Protocols. - Correct
ws://or securewss://URL is used. - Unsupported origin, protocol and version are rejected as designed.
- Open, close and error states appear correctly in the UI.
- Close code and reason are handled.
- Idle timeout, ping/pong and server restart behaviour are defined.
Messages
| Area | Tests |
|---|---|
| Schema | Required fields, types, version and unknown fields. |
| Values | Empty, boundary, malformed, Unicode and large payload. |
| Ordering | Rapid messages, late messages and sequence numbers. |
| Duplicates | Repeated event does not duplicate state unexpectedly. |
| Binary | Correct type, size and decoding. |
| Errors | Invalid messages do not break the connection or leak details. |
Reconnection and reliability
- Connect and reach a known state.
- Switch DevTools to Offline or disconnect the network.
- Trigger or receive activity.
- Reconnect.
- Verify retry delay, connection status and missed-data recovery.
- No endless rapid reconnect loop.
- Subscriptions are restored once, not duplicated.
- Messages are queued, dropped or replayed according to the contract.
- UI does not show stale data as current.
- Multiple tabs and devices behave correctly.
Authentication and permissions
- Missing, invalid and expired credentials fail.
- Token refresh or reconnect uses current credentials.
- Logout closes or invalidates the connection.
- User cannot subscribe to another user's private channel.
- Role changes take effect as required.
- Origin validation and message-level authorisation are enforced server-side.
- Sensitive tokens are not placed in logged URLs when avoidable.
Debug with DevTools
- Open Network.
- Select the WS filter.
- Choose the WebSocket request.
- Inspect Headers for the handshake.
- Open Messages to inspect sent and received frames.
- Record timestamp, direction, payload and close details.
Evidence safety: WebSocket frames may contain tokens, chat content or personal data. Redact before sharing.