SDLC — A QA Engineer’s Perspective

Playwright can repeat the logout, redirect and protected-page checks using stable role / label locators and meaningful assertions. CI can run smoke checks on relevant changes, broader regression on candidates, and retain logs, screenshots, traces and reports for investigation.

UI automation alone does not prove backend session revocation. A separate service-level check must attempt to reuse the same pre-logout session. The existing examples below require a configured QA app and disposable test accounts.

Browser E2E (end-to-end) example

// Illustrative QA app contract, not the separate SauceDemo example.
// baseURL and isolated test-account credentials come from QA configuration.
import { test, expect, type Page } from '@playwright/test';

class AccountPage {
  constructor(private readonly page: Page) {}
  async logout() {
    await this.page.getByRole('button', { name: 'Log out', exact: true }).click();
  }
}

test('TC-LOGOUT-002: protected page requires login after logout', async ({ page }) => {
  await page.goto('/login');
  await page.getByLabel('Username', { exact: true }).fill(process.env.QA_TEST_USER!);
  await page.getByLabel('Password', { exact: true }).fill(process.env.QA_TEST_PASSWORD!);
  await page.getByRole('button', { name: 'Sign in', exact: true }).click();
  await expect(page).toHaveURL(/\/account$/);
  await expect(page.getByRole('heading', { name: 'Your account', exact: true })).toBeVisible();

  await new AccountPage(page).logout();
  await expect(page).toHaveURL(/\/login$/);
  await expect(page.getByRole('button', { name: 'Sign in', exact: true })).toBeVisible();

  await page.goto('/account');
  await expect(page).toHaveURL(/\/login$/);
  await expect(page.getByRole('heading', { name: 'Your account', exact: true })).toHaveCount(0);
});

Separate service-level session replay check

// Separate service-level check for the agreed opaque-session contract.
// Test fixture supplies an isolated account and cleans up its sessions.
import { test, expect } from '@playwright/test';

test('TC-LOGOUT-001: old session cannot access protected data', async ({ request }) => {
  const login = await request.post('/api/auth/login', { data: {
    username: process.env.QA_TEST_USER,
    password: process.env.QA_TEST_PASSWORD,
  } });
  expect(login.status()).toBe(200);
  const { token } = await login.json();
  const headers = { Authorization: `Bearer ${token}` };
  try {
    const logout = await request.post('/api/auth/logout', { headers });
    expect(logout.status()).toBe(204);
    const replay = await request.get('/api/account', { headers });
    expect(replay.status()).toBe(401); // the SAME pre-logout token
  } finally {
    await request.post('/api/auth/logout', { headers });
  }
});

Jenkins evidence configuration · illustrative fragment

// Playwright configuration: HTML + JUnit reporters;
// trace: retain-on-failure; screenshot: only-on-failure
// Jenkins agent: Node, locked dependencies and matching browsers installed
// Test step: npx playwright test
post {
  always {
    junit 'test-results/junit.xml'
    archiveArtifacts artifacts: 'playwright-report/**,test-results/**'
  }
}

The configured reporter path must match Jenkins. Preserve evidence on failure and investigate the assertion, application behavior and environment before classifying the result.

Explore the separate Playwright / Page Object demo ↗ · Open the existing CI Pipeline Lab ↗