Form validation testing checklist
Thirteen checks in the order a value travels: what the control does to it before anyone reads it, what the browser refuses to send, what the server decides, and what the person is left looking at when it fails. The first group comes first because every later check is about a value the field has already edited. On the forms these procedures were written against, typing one space into a text input satisfied a required attribute, a 23 character name passed a maxlength of 10 and came back stored, a value that looks empty in every interface arrived as one character that no required check refuses, and a submit guard that held against ten double clicks failed fourteen times in twenty once it sat behind one await. Each check names what it decides and the layer it decides it at.
13 checksabout 148 min end to end
What the control does before your code sees the value
- How to test whitespace trimming in a form field
trim() removes U+00A0 and U+3000 and stops at U+200B, so a field that looks empty holds one character that is not the empty string. - How to check field length limits in a form
maxlength cuts typing and pasting and does nothing to an assigned value, and it counts UTF-16 units, so eight emoji become five. - Paste event javascript
The pasted value is in the event while the field still holds the old one, and a microtask is not late enough to read it. - Input type number validation
Text typed into a number field leaves the value empty, so a required field reports a missing value the person did enter. - How to check date input parsing in a form
The field yields one fixed format and displays another, and the Date it hands you sits at UTC midnight, which is where the off-by-one day starts.
What the browser refuses to send
- How to check required field validation
A hidden required control blocks the submit with nothing on screen, and a radio member without the attribute still reports a missing value. - Input type email validation
The browser's rule and the backend regex disagreed on seven of twelve addresses, in both directions. - HTML input pattern validation
A pattern that fails to compile under the v flag turns the field into one that accepts everything, with one console line as the only trace.
What the server decides
- How to test that client validation is enforced on the server
Every constraint above is one console line away from gone, and the same fields replayed with curl were stored. - How to test double form submission
The disable that holds against clicks and held Enter keys stops holding as soon as it sits behind an await.
What the person is left with when it fails
- How to test form data is kept after a failed submit
One cache header decided whether the back button restored five fields or six, and the file input cannot be restored at all. - How to check where focus lands after a validation error
An error summary without tabindex takes focus as a no-op, and the property reads the same on the broken container as on the working one. - Autofill testing
The browser filled fields carrying off and fields carrying invented tokens alike, so a watched fill proves nothing about the attribute.
Take it with you
The file is the same list as Markdown checkboxes, ready to paste into a release ticket or a pull request description.
Ticks are kept in this browser only. They are not sent anywhere and other people do not see them.