Response headers in Postman - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the value of the Content-Type header?

You send a GET request to an API endpoint. The response headers include:

Content-Type: application/json; charset=utf-8
Cache-Control: no-cache

What is the exact value of the Content-Type header?

A text/html; charset=utf-8

B application/json

C application/json; charset=utf-8

D no-cache

💡 Hint

Look carefully at the full value after the colon in the Content-Type header.

The Content-Type header specifies the media type and charset. Here it is 'application/json; charset=utf-8'.

❓ assertion

intermediate

Which assertion correctly checks the Cache-Control header?

You want to write a Postman test to verify the response header Cache-Control is exactly 'no-store'. Which assertion code is correct?

Postman

pm.test('Cache-Control is no-store', () => {
    pm.expect(pm.response.headers.get('Cache-Control')).to.eql('no-store');
});

A pm.expect(pm.response.headers.get('cache-control')).to.eql('no-store');

B pm.expect(pm.response.headers.get('Cache-Control')).to.eql('no-store');

C pm.expect(pm.response.headers.get('Cache-Control')).to.equal('no-cache');

D pm.expect(pm.response.headers.get('Cache-Control')).to.be.undefined;

💡 Hint

Header names are case-insensitive but use the exact header name casing for clarity.

Option B correctly uses the exact header name and expected value. Option B uses lowercase header name but headers are case-insensitive, so it works but best practice is to use correct casing. Option B expects wrong value. Option B expects undefined which is incorrect.

🔧 Debug

advanced

Why does this Postman test fail to detect the X-RateLimit-Remaining header?

Consider this test code:

pm.test('Rate limit remaining is 10', () => {
    pm.expect(pm.response.headers.get('x-ratelimit-remaining')).to.eql('10');
});

The test fails even though the response headers include:

X-RateLimit-Remaining: 10

What is the most likely reason?

A Header names are case-sensitive in Postman, so 'x-ratelimit-remaining' does not match 'X-RateLimit-Remaining'.

B The header is missing from the response, so get() returns null.

C The header value is a number, but the test compares it to a string '10'.

D The header name has extra spaces causing mismatch.

💡 Hint

Check how Postman treats header name casing in the get() method.

Postman header names are case-insensitive, but the get() method requires exact casing to find the header. Using lowercase 'x-ratelimit-remaining' does not match 'X-RateLimit-Remaining'.

🧠 Conceptual

advanced

What does the 'Access-Control-Allow-Origin' header control?

In API testing, what is the purpose of the 'Access-Control-Allow-Origin' response header?

A It controls which domains are allowed to access the resource via browsers (CORS policy).

B It sets the cache expiration time for the response.

C It defines the content type of the response body.

D It specifies the allowed HTTP methods for the resource.

💡 Hint

Think about browser security and cross-domain requests.

The 'Access-Control-Allow-Origin' header tells browsers which domains can access the resource, enforcing Cross-Origin Resource Sharing (CORS) policy.

❓ framework

expert

Which Postman test code correctly asserts multiple response headers?

You want to check that the response headers include:

Content-Type: application/json
Cache-Control: no-cache

Which Postman test code correctly asserts both headers in one test?

A

pm.test('Headers check', () => {
  pm.response.to.have.headers({
    'Content-Type': 'application/json',
    'Cache-Control': 'no-cache'
  });
});

B

pm.test('Headers check', () => {
  pm.response.to.have.header('Content-Type', 'application/json');
  pm.response.to.have.header('Cache-Control', 'no-cache');
});

C

pm.test('Headers check', () => {
  pm.expect(pm.response.headers.get('Content-Type')).to.equal('application/json');
  pm.expect(pm.response.headers.get('Cache-Control')).to.equal('no-cache');
});

D

pm.test('Headers check', () => {
  pm.expect(pm.response.headers.get('Content-Type')).to.eql('application/json');
  pm.expect(pm.response.headers.get('Cache-Control')).to.eql('no-cache');
});

💡 Hint

Check which Postman assertion methods support multiple headers at once.

Option D uses pm.expect with get() for each header and compares values correctly. Option D is invalid because pm.response.to.have.header() does not accept two calls in one test block like that. Option D uses .to.equal which is an alias but less common than .to.eql. Option D uses a method pm.response.to.have.headers which does not exist in Postman.