CORS testing in Postman - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding CORS Preflight Requests

Which HTTP method is used by browsers to send a CORS preflight request before the actual request?

A OPTIONS

B GET

C POST

D HEAD

💡 Hint

Think about a method that checks permissions without sending data.

Browsers use the OPTIONS method to send a preflight request to check if the actual request is safe to send.

❓ Predict Output

intermediate

CORS Response Header Behavior

What will be the value of the Access-Control-Allow-Origin header in the response if the server sets it to *?

Postman

GET /api/data HTTP/1.1
Host: example.com
Origin: https://client.com

Response Headers:
Access-Control-Allow-Origin: *

A The browser allows requests from any origin.

B The browser ignores the header and blocks the request.

C The browser allows requests only from https://client.com.

D The browser blocks requests from all origins.

💡 Hint

Consider what the wildcard * means in CORS headers.

The * value means the server allows requests from any origin.

❓ assertion

advanced

Validating CORS Headers in Postman Tests

Which Postman test script correctly asserts that the Access-Control-Allow-Origin header equals https://client.com?

A pm.test('CORS header is correct', () => { pm.response.to.have.header('Access-Control-Allow-Origin', 'https://client.com'); });

B pm.test('CORS header is correct', () => { pm.expect(pm.response.headers.get('Access-Control-Allow-Origin')).to.equal('https://client.com'); });

C pm.test('CORS header is correct', () => { pm.response.headers.has('Access-Control-Allow-Origin', 'https://client.com'); });

D pm.test('CORS header is correct', () => { pm.expect(pm.response.headers.get('Access-Control-Allow-Origin')).to.be.true; });

💡 Hint

Look for the correct way to get a header and compare its value in Postman tests.

Option B correctly retrieves the header value and asserts equality using pm.expect.

🔧 Debug

advanced

Diagnosing CORS Failure in Postman

You send a request from Postman to a server and receive a 200 OK response, but your browser shows a CORS error. Why does this happen?

A The browser caches old CORS headers causing the error.

B The server is blocking Postman requests but allowing browsers.

C Postman automatically adds CORS headers, browsers do not.

D Postman does not enforce CORS, but browsers do.

💡 Hint

Think about how Postman and browsers handle CORS differently.

Postman is a testing tool and does not enforce CORS restrictions, but browsers enforce CORS for security.

❓ framework

expert

Automating CORS Tests in Postman Collection

Which approach best automates testing that a server correctly handles CORS preflight requests in a Postman collection?

A Use Postman to disable CORS enforcement and verify server response status only.

B Send a GET request without Origin header and check for Access-Control-Allow-Origin in response.

C Create a request with method OPTIONS, set Origin header, and assert Access-Control-Allow-* headers in test scripts.

D Send a POST request with Origin header and assert response body contains CORS headers.

💡 Hint

Remember how browsers perform preflight checks and what headers are involved.

Preflight requests use OPTIONS method with Origin header; tests should verify Access-Control-Allow headers in response.