Some Major Test cases for web application cookie testing:
The first obvious test case is to test if your application is writing cookies properly on disk.
Test cases:
1) As a Cookie privacy policy make sure from your design documents that no personal or sensitive data is stored in the cookie.
2) If you have no option than saving sensitive data in cookie make sure data stored in cookie is stored in encrypted format or there is and expiry time/date included
3) Make sure that there is no overuse of cookies on your site under test. Overuse of cookies will annoy users if browser is prompting for cookies more often and this could result in loss of site traffic and eventually loss of business.
4) Disable the cookies from your browser settings: See if appropriate messages are displayed to user like “For smooth functioning of this site make sure that cookies are enabled on your browser”. There should not be any page crash due to disabling the cookies.
5) Accepts/Reject some cookies: The best way to check web site functionality is not to accept all cookies. For executing this test case you can set browser options to prompt whenever cookie is being written to disk. See if pages are getting crashed or data is getting corrupted.
6) Delete cookie: Allow site to write the cookies and then close all browsers and manually delete all cookies for web site under test. Access the web pages and check the behavior of the pages.
7) Corrupt the cookies: Manually edit the cookie and change the parameters to some vague values. Like alter the cookie content Name of the cookie or expiry date of the cookie and see the site functionality.
8 ) Checking the deletion of cookies from your web application page: Some times cookie written by domain say rediff.com may be deleted by same domain but by different page under that domain.
9) Cookie Testing on Multiple browsers
10) If your web application is using cookies to maintain the logging state of any user then log in to your web application using some other username and password. The proper access message should be displayed.