Response headers in Postman - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the value of the Content-Type header?

You send a GET request to an API endpoint. The response headers include:

Content-Type: application/json; charset=utf-8
Cache-Control: no-cache

What is the exact value of the Content-Type header?

A text/html; charset=utf-8

B application/json

C application/json; charset=utf-8

D no-cache

💡 Hint

Look carefully at the full value after the colon in the Content-Type header.

The Content-Type header specifies the media type and charset. Here it is 'application/json; charset=utf-8'.

❓ assertion

intermediate

Which assertion correctly checks the Cache-Control header?

You want to write a Postman test to verify the response header Cache-Control is exactly 'no-store'. Which assertion code is correct?

Postman

pm.test('Cache-Control is no-store', () => {
    pm.expect(pm.response.headers.get('Cache-Control')).to.eql('no-store');
});

A pm.expect(pm.response.headers.get('cache-control')).to.eql('no-store');

B pm.expect(pm.response.headers.get('Cache-Control')).to.eql('no-store');

C pm.expect(pm.response.headers.get('Cache-Control')).to.equal('no-cache');

D pm.expect(pm.response.headers.get('Cache-Control')).to.be.undefined;

💡 Hint

Header names are case-insensitive but use the exact header name casing for clarity.

Option B correctly uses the exact header name and expected value. Option B uses lowercase header name but headers are case-insensitive, so it works but best practice is to use correct casing. Option B expects wrong value. Option B expects undefined which is incorrect.

🔧 Debug

advanced

Why does this Postman test fail to detect the X-RateLimit-Remaining header?

Consider this test code:

pm.test('Rate limit remaining is 10', () => {
    pm.expect(pm.response.headers.get('x-ratelimit-remaining')).to.eql('10');
});

The test fails even though the response headers include:

X-RateLimit-Remaining: 10

What is the most likely reason?

A Header names are case-sensitive in Postman, so 'x-ratelimit-remaining' does not match 'X-RateLimit-Remaining'.

B The header is missing from the response, so get() returns null.

C The header value is a number, but the test compares it to a string '10'.

D The header name has extra spaces causing mismatch.

💡 Hint

Check how Postman treats header name casing in the get() method.

Postman header names are case-insensitive, but the get() method requires exact casing to find the header. Using lowercase 'x-ratelimit-remaining' does not match 'X-RateLimit-Remaining'.

🧠 Conceptual

advanced

What does the 'Access-Control-Allow-Origin' header control?

In API testing, what is the purpose of the 'Access-Control-Allow-Origin' response header?

A It controls which domains are allowed to access the resource via browsers (CORS policy).

B It sets the cache expiration time for the response.

C It defines the content type of the response body.

D It specifies the allowed HTTP methods for the resource.

💡 Hint

Think about browser security and cross-domain requests.

The 'Access-Control-Allow-Origin' header tells browsers which domains can access the resource, enforcing Cross-Origin Resource Sharing (CORS) policy.

❓ framework

expert

Which Postman test code correctly asserts multiple response headers?

You want to check that the response headers include:

Content-Type: application/json
Cache-Control: no-cache

Which Postman test code correctly asserts both headers in one test?

A

pm.test('Headers check', () => {
  pm.response.to.have.headers({
    'Content-Type': 'application/json',
    'Cache-Control': 'no-cache'
  });
});

B

pm.test('Headers check', () => {
  pm.response.to.have.header('Content-Type', 'application/json');
  pm.response.to.have.header('Cache-Control', 'no-cache');
});

C

pm.test('Headers check', () => {
  pm.expect(pm.response.headers.get('Content-Type')).to.equal('application/json');
  pm.expect(pm.response.headers.get('Cache-Control')).to.equal('no-cache');
});

D

pm.test('Headers check', () => {
  pm.expect(pm.response.headers.get('Content-Type')).to.eql('application/json');
  pm.expect(pm.response.headers.get('Cache-Control')).to.eql('no-cache');
});

💡 Hint

Check which Postman assertion methods support multiple headers at once.

Option D uses pm.expect with get() for each header and compares values correctly. Option D is invalid because pm.response.to.have.header() does not accept two calls in one test block like that. Option D uses .to.equal which is an alias but less common than .to.eql. Option D uses a method pm.response.to.have.headers which does not exist in Postman.

Practice

1. What does the pm.response.headers.get('Content-Type') command do in Postman tests?

easy

A. It lists all headers in the response.

B. It sets the 'Content-Type' header in the request.

C. It deletes the 'Content-Type' header from the response.

D. It retrieves the value of the 'Content-Type' header from the response.

Solution

1. Step 1: Understand the method purpose

   The method pm.response.headers.get() is used to read a specific header from the response.

2. Step 2: Apply to 'Content-Type' header

   Using 'Content-Type' as the argument returns the value of that header from the server's reply.

3. Final Answer:

   It retrieves the value of the 'Content-Type' header from the response. -> Option D

4. Quick Check:

   pm.response.headers.get('Content-Type') = header value [OK]

Hint: Get header value with pm.response.headers.get('Header-Name') [OK]

Common Mistakes:

• Confusing get() with setting headers
• Thinking it deletes headers
• Assuming it returns all headers

2. Which of the following is the correct syntax to check if the response header 'Cache-Control' equals 'no-cache' in a Postman test script?

easy

A. pm.response.headers.get('Cache-Control') === 'no-cache';

B. pm.response.headers['Cache-Control'] == 'no-cache';

C. pm.response.headers.get('Cache-Control') = 'no-cache';

D. pm.response.headers.has('Cache-Control', 'no-cache');

Solution

1. Step 1: Identify correct method to get header value

   The method to get a header value is pm.response.headers.get('Header-Name').

2. Step 2: Use strict equality to compare value

   To check if the header equals 'no-cache', use === 'no-cache' for exact match.

3. Final Answer:

   pm.response.headers.get('Cache-Control') === 'no-cache'; -> Option A

4. Quick Check:

   Use get() + === for header value check [OK]

Hint: Use get() and === to compare header values correctly [OK]

Common Mistakes:

• Using single = instead of === for comparison
• Trying to access headers like an object property
• Using non-existent has() method with two arguments

3. Given this Postman test code:

const server = pm.response.headers.get('Server');
pm.test('Server header is Apache', () => {
  pm.expect(server).to.equal('Apache');
});

What will happen if the response header 'Server' is actually 'nginx'?

medium

A. The test will fail because the header value is not 'Apache'.

B. The test will be skipped automatically.

C. The test will throw a syntax error.

D. The test will pass because the header exists.

Solution

1. Step 1: Understand the test expectation

   The test expects the 'Server' header value to be exactly 'Apache'.

2. Step 2: Compare actual header value

   If the actual header is 'nginx', the expectation pm.expect(server).to.equal('Apache') will fail.

3. Final Answer:

   The test will fail because the header value is not 'Apache'. -> Option A

4. Quick Check:

   Expected 'Apache', got 'nginx' = fail [OK]

Hint: Test fails if header value differs from expected string [OK]

Common Mistakes:

• Assuming test passes if header exists
• Confusing syntax error with assertion failure
• Thinking test skips on mismatch

4. You wrote this Postman test to check the 'Content-Length' header:

pm.test('Content-Length is 1234', () => {
  pm.expect(pm.response.headers.get('Content-Length')).to.equal(1234);
});

But the test always fails even when the header shows '1234'. What is the likely problem?

medium

A. pm.response.headers.get() cannot read 'Content-Length'.

B. The header name is case-sensitive and should be lowercase.

C. The header value is a string, but test compares to a number.

D. The test syntax is invalid and causes an error.

Solution

1. Step 1: Check data types in comparison

   The header value returned by pm.response.headers.get() is always a string.

2. Step 2: Identify mismatch in expected value type

   The test compares the string '1234' to the number 1234, causing the equality check to fail.

3. Final Answer:

   The header value is a string, but test compares to a number. -> Option C

4. Quick Check:

   Compare string to string to pass test [OK]

Hint: Compare header values as strings, not numbers [OK]

Common Mistakes:

• Comparing string header to number directly
• Assuming header names are case-sensitive
• Believing get() cannot read standard headers

5. You want to write a Postman test that fails if the response does NOT include the header X-Security or if its value is not enabled. Which code snippet correctly implements this?

hard

A. pm.test('X-Security header check', () => {
const header = pm.response.headers.get('X-Security');
pm.expect(header || 'enabled').to.equal('enabled');
});

B. pm.test('X-Security header check', () => {
pm.expect(pm.response.headers.has('X-Security')).to.be.true;
pm.expect(pm.response.headers.get('X-Security')).to.equal('enabled');
});

C. pm.test('X-Security header check', () => {
pm.expect(pm.response.headers.get('X-Security')).to.be.true;
pm.expect(pm.response.headers.get('X-Security')).to.equal('enabled');
});

D. pm.test('X-Security header check', () => {
pm.expect(pm.response.headers.has('X-Security', 'enabled')).to.be.true;
});

Solution

1. Step 1: Check header existence explicitly

   Use pm.response.headers.has('X-Security') to confirm the header is present.

2. Step 2: Verify header value equals 'enabled'

   Use pm.response.headers.get('X-Security') and compare with 'enabled' using to.equal().

3. Step 3: Combine both checks in one test

   Both conditions must be true for the test to pass, ensuring header presence and correct value.

4. Final Answer:

   Use has() to check presence and get() to check value. -> Option B

5. Quick Check:

   has() + get() ensures header exists and matches value [OK]

Hint: Use has() to check header exists before checking value [OK]

Common Mistakes:

• Not checking header existence before value
• Using get() without verifying header presence
• Assuming get() returns undefined if header missing