CORS testing in Postman - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set the HTTP method for a CORS preflight request in Postman.

Postman

pm.sendRequest({ method: '[1]', url: 'https://api.example.com/data' }, function (err, res) { console.log(res.status); });

Drag options to blanks, or click blank then click option'

AGET

BPOST

CPUT

DOPTIONS

Attempts:

3 left

💡 Hint

Common Mistakes

Using GET or POST instead of OPTIONS for preflight requests.

The CORS preflight request uses the HTTP OPTIONS method to check permissions before the actual request.

2fill in blank

medium

Complete the code to add the 'Origin' header in a Postman request for CORS testing.

Postman

pm.sendRequest({ url: 'https://api.example.com/data', method: 'GET', headers: { 'Origin': '[1]' } }, function (err, res) { console.log(res.headers.get('Access-Control-Allow-Origin')); });

Drag options to blanks, or click blank then click option'

Ahttps://malicious.com

Bhttps://trusted.com

Clocalhost

Dexample.com

Attempts:

3 left

💡 Hint

Common Mistakes

Using incomplete or incorrect Origin header values like just domain names without protocol.

The Origin header should be set to the domain you want to test CORS permissions for, such as a trusted domain.

3fill in blank

hard

Fix the error in the Postman test script to correctly check if CORS allows the origin.

Postman

pm.test('CORS allows origin', function () { pm.expect(pm.response.headers.get('[1]')).to.eql('https://trusted.com'); });

Drag options to blanks, or click blank then click option'

AAccess-Control-Allow-Origin

BAccess-Control-Allow-Credentials

CAccess-Control-Request-Method

DOrigin

Attempts:

3 left

💡 Hint

Common Mistakes

Checking the 'Origin' header instead of 'Access-Control-Allow-Origin'.

The server sends the Access-Control-Allow-Origin header to indicate which origins are allowed.

4fill in blank

hard

Fill both blanks to create a Postman request that sends a custom header and checks if the server allows it via CORS.

Postman

pm.sendRequest({ url: 'https://api.example.com/data', method: 'GET', headers: { '[1]': 'customValue', 'Origin': 'https://trusted.com' } }, function (err, res) { pm.test('Server allows custom header', function () { pm.expect(res.headers.get('[2]')).to.include('[1]'); }); });

Drag options to blanks, or click blank then click option'

AX-Custom-Header

BAccess-Control-Allow-Headers

CAuthorization

DAccess-Control-Allow-Origin

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Authorization' as custom header name.

Checking 'Access-Control-Allow-Origin' instead of 'Access-Control-Allow-Headers'.

The custom header is named X-Custom-Header. The server indicates allowed headers in Access-Control-Allow-Headers.

5fill in blank

hard

Fill all three blanks to write a Postman test that verifies the server supports credentials in CORS.

Postman

pm.sendRequest({ url: 'https://api.example.com/data', method: 'GET', headers: { 'Origin': '[1]' }, credentials: '[2]' }, function (err, res) { pm.test('CORS supports credentials', function () { pm.expect(res.headers.get('[3]')).to.eql('true'); }); });

Drag options to blanks, or click blank then click option'

Ahttps://trusted.com

Binclude

CAccess-Control-Allow-Credentials

Domit

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'omit' for credentials disables cookies.

Checking wrong headers for credentials support.

The Origin header is set to the trusted domain. The credentials option must be include to send cookies. The server indicates support with Access-Control-Allow-Credentials header set to 'true'.