Response headers in Postman - Cheat Sheet & Quick Revision

Recall & Review

beginner

What are response headers in API testing?

Response headers are pieces of information sent by the server back to the client along with the response body. They describe details like content type, server info, caching policies, and more.

beginner

Name two common response headers you might check in Postman.

Common response headers include Content-Type (tells the format of the response data) and Server (provides information about the server software).

intermediate

How can you verify response headers in Postman tests?

You can write tests in Postman using JavaScript to check if specific headers exist or have expected values, for example:
pm.test('Content-Type is JSON', () => { pm.response.to.have.header('Content-Type', 'application/json'); });

beginner

Why is checking response headers important in API testing?

Response headers provide metadata about the response. Checking them ensures the server behaves correctly, like sending the right content type or security policies, which affects how clients handle the response.

intermediate

What does the Cache-Control response header do?

The Cache-Control header tells the client or browser how to cache the response. For example, it can say to not cache at all or to cache for a certain time.

Which response header tells the client the format of the returned data?

A Accept

B Content-Type

C User-Agent

D Authorization

The Content-Type header specifies the media type of the response body, such as application/json or text/html.

In Postman, how do you check if a response header exists in a test script?

A pm.response.hasHeader('Header-Name')

B pm.request.to.have.header('Header-Name')

C pm.testHeader('Header-Name')

D pm.response.to.have.header('Header-Name')

The correct syntax to check for a header in Postman test scripts is pm.response.to.have.header('Header-Name').

What does the Cache-Control header control?

A The HTTP method used

B The server's IP address

C How the response is cached by clients

D The response status code

Cache-Control tells clients or browsers how to cache the response data.

Which header would you check to confirm the server's software information?

A Server

B Content-Length

C Host

D Referer

The Server header often contains information about the server software handling the request.

Why might you test response headers in API testing?

A To verify metadata like content type and security policies

B To check the client’s IP address

C To change the request method

D To modify the response body

Testing response headers ensures the server sends correct metadata that affects how clients process the response.

Explain what response headers are and why they matter in API testing.

Think about the extra information the server sends besides the main data.

Describe how you would write a Postman test to check if the response has a specific header with a certain value.

Use JavaScript syntax inside Postman test scripts.

Practice

1. What does the pm.response.headers.get('Content-Type') command do in Postman tests?

easy

A. It lists all headers in the response.

B. It sets the 'Content-Type' header in the request.

C. It deletes the 'Content-Type' header from the response.

D. It retrieves the value of the 'Content-Type' header from the response.

Solution

1. Step 1: Understand the method purpose

   The method pm.response.headers.get() is used to read a specific header from the response.

2. Step 2: Apply to 'Content-Type' header

   Using 'Content-Type' as the argument returns the value of that header from the server's reply.

3. Final Answer:

   It retrieves the value of the 'Content-Type' header from the response. -> Option D

4. Quick Check:

   pm.response.headers.get('Content-Type') = header value [OK]

Hint: Get header value with pm.response.headers.get('Header-Name') [OK]

Common Mistakes:

• Confusing get() with setting headers
• Thinking it deletes headers
• Assuming it returns all headers

2. Which of the following is the correct syntax to check if the response header 'Cache-Control' equals 'no-cache' in a Postman test script?

easy

A. pm.response.headers.get('Cache-Control') === 'no-cache';

B. pm.response.headers['Cache-Control'] == 'no-cache';

C. pm.response.headers.get('Cache-Control') = 'no-cache';

D. pm.response.headers.has('Cache-Control', 'no-cache');

Solution

1. Step 1: Identify correct method to get header value

   The method to get a header value is pm.response.headers.get('Header-Name').

2. Step 2: Use strict equality to compare value

   To check if the header equals 'no-cache', use === 'no-cache' for exact match.

3. Final Answer:

   pm.response.headers.get('Cache-Control') === 'no-cache'; -> Option A

4. Quick Check:

   Use get() + === for header value check [OK]

Hint: Use get() and === to compare header values correctly [OK]

Common Mistakes:

• Using single = instead of === for comparison
• Trying to access headers like an object property
• Using non-existent has() method with two arguments

3. Given this Postman test code:

const server = pm.response.headers.get('Server');
pm.test('Server header is Apache', () => {
  pm.expect(server).to.equal('Apache');
});

What will happen if the response header 'Server' is actually 'nginx'?

medium

A. The test will fail because the header value is not 'Apache'.

B. The test will be skipped automatically.

C. The test will throw a syntax error.

D. The test will pass because the header exists.

Solution

1. Step 1: Understand the test expectation

   The test expects the 'Server' header value to be exactly 'Apache'.

2. Step 2: Compare actual header value

   If the actual header is 'nginx', the expectation pm.expect(server).to.equal('Apache') will fail.

3. Final Answer:

   The test will fail because the header value is not 'Apache'. -> Option A

4. Quick Check:

   Expected 'Apache', got 'nginx' = fail [OK]

Hint: Test fails if header value differs from expected string [OK]

Common Mistakes:

• Assuming test passes if header exists
• Confusing syntax error with assertion failure
• Thinking test skips on mismatch

4. You wrote this Postman test to check the 'Content-Length' header:

pm.test('Content-Length is 1234', () => {
  pm.expect(pm.response.headers.get('Content-Length')).to.equal(1234);
});

But the test always fails even when the header shows '1234'. What is the likely problem?

medium

A. pm.response.headers.get() cannot read 'Content-Length'.

B. The header name is case-sensitive and should be lowercase.

C. The header value is a string, but test compares to a number.

D. The test syntax is invalid and causes an error.

Solution

1. Step 1: Check data types in comparison

   The header value returned by pm.response.headers.get() is always a string.

2. Step 2: Identify mismatch in expected value type

   The test compares the string '1234' to the number 1234, causing the equality check to fail.

3. Final Answer:

   The header value is a string, but test compares to a number. -> Option C

4. Quick Check:

   Compare string to string to pass test [OK]

Hint: Compare header values as strings, not numbers [OK]

Common Mistakes:

• Comparing string header to number directly
• Assuming header names are case-sensitive
• Believing get() cannot read standard headers

5. You want to write a Postman test that fails if the response does NOT include the header X-Security or if its value is not enabled. Which code snippet correctly implements this?

hard

A. pm.test('X-Security header check', () => {
const header = pm.response.headers.get('X-Security');
pm.expect(header || 'enabled').to.equal('enabled');
});

B. pm.test('X-Security header check', () => {
pm.expect(pm.response.headers.has('X-Security')).to.be.true;
pm.expect(pm.response.headers.get('X-Security')).to.equal('enabled');
});

C. pm.test('X-Security header check', () => {
pm.expect(pm.response.headers.get('X-Security')).to.be.true;
pm.expect(pm.response.headers.get('X-Security')).to.equal('enabled');
});

D. pm.test('X-Security header check', () => {
pm.expect(pm.response.headers.has('X-Security', 'enabled')).to.be.true;
});

Solution

1. Step 1: Check header existence explicitly

   Use pm.response.headers.has('X-Security') to confirm the header is present.

2. Step 2: Verify header value equals 'enabled'

   Use pm.response.headers.get('X-Security') and compare with 'enabled' using to.equal().

3. Step 3: Combine both checks in one test

   Both conditions must be true for the test to pass, ensuring header presence and correct value.

4. Final Answer:

   Use has() to check presence and get() to check value. -> Option B

5. Quick Check:

   has() + get() ensures header exists and matches value [OK]

Hint: Use has() to check header exists before checking value [OK]

Common Mistakes:

• Not checking header existence before value
• Using get() without verifying header presence
• Assuming get() returns undefined if header missing