How to write a test case for CAPTCHA code

Question

In our project we have a user to sign on after filling the CAPTCHA code. Right now it's working fine and I am a beginner to this field.

I am confused how to write a test case for the CAPTCHA code

Answer 1

Many of the preceding answers are directed at testing the behavior of the captcha from a customers POV (enter valid, invalid, etc.). But, if you are testing an actual captcha generator that your dev's wrote then you should go deeper. Also, there is some important information about the captcha generator you're testing that would be important for functional testing.

For example,

• Will you need to test your hash function for collisions?
• Rather then trying to create a "dummy captcha" I would recommend trying to use a robot to successfully read the captcha.
• Also, does your captcha employ a proxy block if the IP address is hidden?
• Which fonts are used, and are they used with sufficient randomness?
• Which characters are used (e.g. upper and lower case, numbers, etc) in a captcha?

Some other information needed for behavioral testing from the UI could include

• Does your captcha have audio for sight impaired customers?
• Captcha resets/or getting new captcha.
• Does the width of the bitmap of the captcha displayed to the user vary, and if so how does it appear on different resolutions?
• Readability of captcha by human vs. robot.
• Input validation?

Answer 2

There are two questions here: (1) test case itself; (2) ability to automate testing.

As per the first topic, you just describe it in a form of Actor - Action - Result, e.g.:

• System redirects to a page XX
• User types CAPTCHA code into a field [...]
• System checks answer validity
• If the key is not valid, System redirects to Step N
• System redirects to "Completion" page

or, alternatively (depending on your policy of writing TC's):

• System redirects to a "CAPTCHA" page
• User types a valid code into a field [...]
• System redirects to "Completion" page
• Alt flow at Step N
  • User types an invalid CAPTCHA code into a field [...]
  • System redirects to Step N

Automating this process is slightly different. Since the key to testing is ability to reproduce, you can't afford different CAPTCHA's within the same test. However, you can (and should) make tests for valid, invalid, empty responses.

For this purpose, you should develop a dummy CAPTCHA provider that will have exactly the same interface as the "production" CAPTCHA provider has, but will return only a well-known image(s).
Then, your automated code will attempt "solving" this CAPTCHA with various answers (valid, invalid, empty, and so on).

Answer 3

The purpose of a CAPTCHA is to verify a human is submitting the form. By definition, if you could automate this interaction, the functionality would fail. But you didn't ask about automation, so that's just an aside.

Think about it from a functional perspective - does it let you submit when you enter the right input? Does it keep you out if you don't enter the right input? What kinds of invalid input might trick it into letting you in?

Think about it from a usability perspective - is the CAPTCHA easy enough for a human to read? Is it still tough enough for a program to detect and read?

Do some research about CAPTCHAs and how they've been known to succeed and fail. That may give you ideas about how to test.

Have a look at this testing Cheat Sheet for some more ideas. If you're a beginner, it may help you with future tests too.

Answer 4

Example for manual testing, if you mean it:

• TC1: try to enter the captcha right, expected: you are allowed
• TC2: try to enter the captcha wrong, expected: you are not allowed
• TC3: try to enter the captcha with Upper/Lower Case Mix, expected (depends on reqs, mostly): you are allowed
• TC4: try to proceed without entering, expected: you are not allowed.

Answer 5

For me the CAPTCHA consists of different sub-modules:

• generation of the CAPTCHA content as text representation plus some random elements like colors/noise that is added to the image.
• generation of a CAPTCHA image that will be presented to the user
• CAPTCHA decision logic/controller that decides if CAPTCHA is entered ok/not ok/create a new CAPTCHA

If implemented via interfaces (dependency injection) you can test some functionality in isolation:

• with a mocked generator you can make regression tests that make sure that a given set of "generated CAPTCHA" result in the same image as previons so you can bitcompare the images.
• you can unit test the generator that every generation fullfills your requirement:
  • number of characters in the generated string
  • type of allowed/disallowed chars