Session Persistence

Overview

Session Persistence allows workflows to maintain application state and user sessions across multiple test steps and workflow executions. This is critical for realistic end-to-end testing where tests need to maintain login sessions or application state throughout the workflow.

---

Why Session Persistence Matters

Realistic Testing

Tests execute exactly like real users - maintaining login sessions across multiple pages/actions.

State Management

Cookie & Token Handling

Cross-Workflow Sessions

---

How Session Persistence Works

Session Lifecycle

Workflow Start
  ├── Step 1: Login
  │   └── Session created (cookies, tokens stored)
  ├── Step 2: Navigate to Account
  │   └── Session maintained (credentials available)
  ├── Step 3: Update Profile
  │   └── Session still active (no re-login needed)
  └── Step 4: Logout
      └── Session ended

Without Session Persistence

Step 1: Login → Session created
Step 2: Navigate → Need to login again!
Step 3: Update → Need to login again!

With Session Persistence

Step 1: Login → Session created
Step 2: Navigate → Session active (logged in)
Step 3: Update → Session active (logged in)

---

Configuring Session Persistence

Enable Session Persistence

1. Open workflow

2. Click "Settings" or "Configuration"

3. Find "Session Management" section

4. Toggle "Enable Session Persistence" ON

5. Configure options (see below)

6. Save settings

Session Configuration Options

Session Persistence Settings
├── Enabled: On/Off toggle
├── Session Duration: Timeout after X minutes
├── Clear Between Steps: Keep or clear after each step
├── Share Across Workflows: Maintain between workflows
├── Cookie Storage: Browser / Server
├── Token Management: Auto-refresh tokens
└── Cleanup: Clear sessions after workflow

---

Session Types

Web Application Sessions

For Web-based testing:

Cookies

• Maintained automatically

• Browser-based storage

• Persist across page navigations

Tokens (JWT, OAuth)

• Automatically captured and reused

• Headers included in subsequent requests

• Auto-refresh if supported

Local Storage

• Application state preservation

• Cache maintenance

• Session variables

Mobile Application Sessions

For Mobile testing:

App State

• Navigation history preserved

• In-app sessions maintained

• App state persisted

Authentication

• Token-based authentication maintained

• Session cookies for mobile apps

• Deep link sessions preserved

API Testing Sessions

For API workflows:

Authorization Headers

• Bearer tokens maintained

• Session tokens in requests

• Custom headers preserved

Request/Response State

• Responses available to subsequent requests

• Authentication context maintained

• Error states preserved

---

Session Data Management

What Gets Persisted?

Session Data Includes:
├── Cookies
├── Authentication tokens
├── Session IDs
├── Browser cache
├── Local storage
├── Session storage
└── Custom application state

What Gets Cleared?

Based on Configuration:
├── Sensitive data (passwords)
├── Temporary session files
├── Browser cache (optional)
├── Cookies older than timeout
└── Expired tokens

---

Real-World Examples

Example 1: E-Commerce Checkout Flow

Workflow: Complete Purchase

Step 1: Login
  ├── User credentials provided
  └── Session created (authentication token stored)

Step 2: Browse Products
  ├── User navigates product catalog
  ├── Session persisted (still logged in)
  └── Shopping cart state maintained

Step 3: Add to Cart
  ├── Item added to cart
  ├── Session used (user cart linked to session)
  └── Session state updated

Step 4: Checkout
  ├── Payment information provided
  ├── Session used (user account linked to order)
  └── Session expires after timeout

Example 2: Multi-Step Form

Workflow: User Registration

Step 1: Fill Page 1 (Personal Info)
  └── Session created

Step 2: Fill Page 2 (Address)
  └── Session maintained, form data preserved

Step 3: Fill Page 3 (Payment)
  └── Session maintained, all previous data available

Step 4: Submit
  └── Session used to link all form data

Example 3: API Workflow

Workflow: Order Management

Step 1: Authenticate API
  ├── POST /auth → Get token
  └── Token stored in session

Step 2: Create Order
  ├── POST /orders (with Bearer token from session)
  └── Order ID returned and stored

Step 3: Update Order
  ├── PUT /orders/{id} (with Bearer token from session)
  └── Uses Order ID from Step 2

Step 4: Get Invoice
  ├── GET /invoices (with Bearer token from session)
  └── Uses Order ID to retrieve invoice

---

Session Timeout Configuration

Setting Timeout Duration

Session Timeout Options:
├── 5 minutes (for short workflows)
├── 15 minutes (standard)
├── 30 minutes (longer workflows)
├── 1 hour (extended workflows)
└── Custom duration

Timeout Behavior

1. Inactive for X minutes → Session marked as expired

2. Next action attempted → Session refresh attempted

3. If refresh fails → Need to re-authenticate

4. If refresh succeeds → Workflow continues

Renewing Sessions

Auto-renew sessions:

1. Enable "Auto-renew on activity"

2. Each action resets timeout

3. Long workflows stay active

4. No manual re-login needed

---

Cross-Workflow Sessions

Scenario: Multiple Related Workflows

Workflow A: Create User
  └── Session ends (user created, logged in)

Workflow B: Verify User Email (runs immediately after)
  └── Should maintain session? (Configuration dependent)

Without Cross-Workflow Sessions:
  - Workflow B must login again

With Cross-Workflow Sessions:
  - Workflow B uses same session from Workflow A
  - No additional login needed

Enabling Cross-Workflow Sessions

1. Open workflow configuration

2. Check "Share sessions with next workflow"

3. Or enable at workflow chain level

---

Security Considerations

✅ Security Best Practices

• ✅ Use HTTPS for all secure connections

• ✅ Don't store passwords in session

• ✅ Use token-based authentication

• ✅ Set appropriate timeout values

• ✅ Clear sessions after workflow completes

• ✅ Use least-privilege test accounts

• ✅ Encrypt session data in transit

⚠️ Security Risks

• ⚠️ Session hijacking if not over HTTPS

• ⚠️ Leaked credentials if stored in logs

• ⚠️ Unauthorized access if session shared improperly

• ⚠️ Stale sessions consuming resources

• ⚠️ Sensitive data in session storage

---

Troubleshooting Session Issues

Issue: Session expires during workflow

Symptoms:

• "Session expired" error mid-workflow

• Need to re-login unexpectedly

• Workflow fails at random steps

Solutions:

1. Increase session timeout duration

2. Enable "Auto-renew on activity"

3. Reduce workflow execution time

4. Check network connectivity

5. Verify no session timeout on server side

Issue: Can't maintain session across steps

Symptoms:

• Each step requires separate login

• Cookies not persisted

• Session disabled after each step

Solutions:

1. Verify "Session Persistence" is enabled

2. Check "Clear Between Steps" is OFF

3. Verify cookies are enabled

4. Check for cookie restrictions

5. Review browser/app settings

Issue: Session not shared between workflows

Symptoms:

• Second workflow doesn't recognize login

• Session starts fresh each workflow

• Multiple logins required

Solutions:

1. Enable "Share sessions with next workflow"

2. Verify workflows run sequentially

3. Check timeout between workflows

4. Verify cross-workflow configuration

Issue: Sensitive data in sessions

Symptoms:

• Passwords visible in logs

• Authentication tokens exposed

• Session data readable

Solutions:

1. Review session storage settings

2. Enable sensitive data filtering

3. Use token-based auth instead of passwords

4. Check log redaction settings

5. Encrypt session data

---

Best Practices

✅ Do

• Enable session persistence for realistic testing

• Set appropriate timeout values

• Use token-based authentication when possible

• Test login/logout sequences

• Clear sessions after each workflow run

• Monitor session performance

• Document session requirements

• Use HTTPS for secure sessions

❌ Don't

• Store passwords in sessions

• Use default timeout values without testing

• Share sessions across unrelated workflows

• Leave long-running sessions active

• Assume sessions work without testing

• Log session data with sensitive info

• Mix session types in same workflow

• Forget to clean up sessions

---

Performance Impact

Memory Usage

Session storage uses memory:

• Simple cookies: ~1-5 KB per session

• Complex sessions: ~10-50 KB per session

• Long-running workflows: Maintain for duration

• Multiple concurrent: Multiply by number of workflows

Optimization Tips

• Clear sessions between workflows when possible

• Use appropriate timeout values

• Don't store unnecessary data

• Monitor session count and size

• Cleanup old/expired sessions

---

Testing Session Persistence

Verification Steps

1. Login in Step 1

2. Verify logged-in state in Step 2 (no login required)

3. Check cookies/tokens persisted

4. Verify application maintains state

5. Confirm session expires correctly

Test Scenario

Test: Session Persistence

Prerequisites:
- Valid test user credentials
- Application with session support

Steps:
1. Login with credentials
2. Navigate to another page (verify still logged in)
3. Perform action requiring authentication
4. Wait for timeout duration
5. Attempt action (verify session expired or renewed)

Expected Results:
- Steps 2-3: User remains logged in
- Step 5: Session expires or auto-renews based on config

---

Related Topics

• Workflows

• Execution Flow

• Data Propagation

• Run Configuration

• Security