CORS testing in Postman - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set the HTTP method for a CORS preflight request in Postman.

Postman

pm.sendRequest({ method: '[1]', url: 'https://api.example.com/data' }, function (err, res) { console.log(res.status); });

Drag options to blanks, or click blank then click option'

AGET

BPOST

CPUT

DOPTIONS

Attempts:

3 left

💡 Hint

Common Mistakes

Using GET or POST instead of OPTIONS for preflight requests.

The CORS preflight request uses the HTTP OPTIONS method to check permissions before the actual request.

2fill in blank

medium

Complete the code to add the 'Origin' header in a Postman request for CORS testing.

Postman

pm.sendRequest({ url: 'https://api.example.com/data', method: 'GET', headers: { 'Origin': '[1]' } }, function (err, res) { console.log(res.headers.get('Access-Control-Allow-Origin')); });

Drag options to blanks, or click blank then click option'

Ahttps://malicious.com

Bhttps://trusted.com

Clocalhost

Dexample.com

Attempts:

3 left

💡 Hint

Common Mistakes

Using incomplete or incorrect Origin header values like just domain names without protocol.

The Origin header should be set to the domain you want to test CORS permissions for, such as a trusted domain.

3fill in blank

hard

Fix the error in the Postman test script to correctly check if CORS allows the origin.

Postman

pm.test('CORS allows origin', function () { pm.expect(pm.response.headers.get('[1]')).to.eql('https://trusted.com'); });

Drag options to blanks, or click blank then click option'

AAccess-Control-Allow-Origin

BAccess-Control-Allow-Credentials

CAccess-Control-Request-Method

DOrigin

Attempts:

3 left

💡 Hint

Common Mistakes

Checking the 'Origin' header instead of 'Access-Control-Allow-Origin'.

The server sends the Access-Control-Allow-Origin header to indicate which origins are allowed.

4fill in blank

hard

Fill both blanks to create a Postman request that sends a custom header and checks if the server allows it via CORS.

Postman

pm.sendRequest({ url: 'https://api.example.com/data', method: 'GET', headers: { '[1]': 'customValue', 'Origin': 'https://trusted.com' } }, function (err, res) { pm.test('Server allows custom header', function () { pm.expect(res.headers.get('[2]')).to.include('[1]'); }); });

Drag options to blanks, or click blank then click option'

AX-Custom-Header

BAccess-Control-Allow-Headers

CAuthorization

DAccess-Control-Allow-Origin

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Authorization' as custom header name.

Checking 'Access-Control-Allow-Origin' instead of 'Access-Control-Allow-Headers'.

The custom header is named X-Custom-Header. The server indicates allowed headers in Access-Control-Allow-Headers.

5fill in blank

hard

Fill all three blanks to write a Postman test that verifies the server supports credentials in CORS.

Postman

pm.sendRequest({ url: 'https://api.example.com/data', method: 'GET', headers: { 'Origin': '[1]' }, credentials: '[2]' }, function (err, res) { pm.test('CORS supports credentials', function () { pm.expect(res.headers.get('[3]')).to.eql('true'); }); });

Drag options to blanks, or click blank then click option'

Ahttps://trusted.com

Binclude

CAccess-Control-Allow-Credentials

Domit

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'omit' for credentials disables cookies.

Checking wrong headers for credentials support.

The Origin header is set to the trusted domain. The credentials option must be include to send cookies. The server indicates support with Access-Control-Allow-Credentials header set to 'true'.

Practice

1. What is the main purpose of CORS testing in Postman?

easy

A. To verify if a server allows resource sharing from different origins

B. To check if the server is running the latest software version

C. To test the speed of the API response

D. To validate the syntax of the API request

Solution

1. Step 1: Understand CORS concept

   CORS (Cross-Origin Resource Sharing) controls if a server permits requests from different websites (origins).

2. Step 2: Relate to Postman testing

   In Postman, testing CORS means checking if the server allows resource sharing from other origins.

3. Final Answer:

   To verify if a server allows resource sharing from different origins -> Option A

4. Quick Check:

   CORS testing = verify cross-origin sharing [OK]

Hint: CORS is about sharing resources across websites [OK]

Common Mistakes:

• Confusing CORS with API speed testing
• Thinking CORS checks server software version
• Assuming CORS validates request syntax

2. Which header should you set in Postman to simulate a cross-origin request for CORS testing?

easy

A. Accept-Encoding

B. Authorization

C. Content-Type

D. Origin

Solution

1. Step 1: Identify header for cross-origin requests

   The Origin header tells the server which website is making the request.

2. Step 2: Use in Postman

   Setting the Origin header in Postman simulates a request from that origin for CORS testing.

3. Final Answer:

   Origin -> Option D

4. Quick Check:

   Set Origin header to test CORS [OK]

Hint: Set 'Origin' header to mimic browser cross-site requests [OK]

Common Mistakes:

• Using Authorization header instead of Origin
• Confusing Content-Type with Origin
• Not setting any header for CORS simulation

3. You send a request in Postman with header Origin: https://example.com. The server responds with header Access-Control-Allow-Origin: https://example.com. What does this response indicate?

medium

A. The server allows requests only from https://example.com

B. The server has a syntax error in headers

C. The server allows requests from any origin

D. The server denies requests from https://example.com

Solution

1. Step 1: Understand Access-Control-Allow-Origin header

   This header specifies which origin the server allows for cross-origin requests.

2. Step 2: Match response header with request origin

   The server's response matches the request origin exactly, meaning it allows requests only from that origin.

3. Final Answer:

   The server allows requests only from https://example.com -> Option A

4. Quick Check:

   Matching Access-Control-Allow-Origin means allowed origin [OK]

Hint: Matching Access-Control-Allow-Origin means allowed origin [OK]

Common Mistakes:

• Thinking it denies the origin when it matches
• Assuming wildcard '*' when specific origin is set
• Confusing syntax error with valid header

4. You test CORS in Postman by setting Origin: https://myapp.com, but the server response lacks Access-Control-Allow-Origin header. What is the likely issue?

medium

A. The request method is invalid

B. The server does not support CORS or is misconfigured

C. Postman does not send the Origin header correctly

D. The server is down

Solution

1. Step 1: Check server response headers for CORS

   If Access-Control-Allow-Origin is missing, the server likely does not allow cross-origin requests.

2. Step 2: Rule out Postman or request issues

   Postman sends headers correctly; missing header usually means server misconfiguration or no CORS support.

3. Final Answer:

   The server does not support CORS or is misconfigured -> Option B

4. Quick Check:

   Missing Access-Control-Allow-Origin means no CORS support [OK]

Hint: Missing Access-Control-Allow-Origin means server blocks CORS [OK]

Common Mistakes:

• Blaming Postman for missing headers
• Assuming request method causes missing header
• Thinking server is down without checking status

5. You want to test if a server allows CORS requests from multiple origins using Postman. Which approach is best to verify this?

hard

A. Send requests with random headers and check response time

B. Send one request without Origin header and check server status

C. Send multiple requests with different Origin headers and check Access-Control-Allow-Origin in each response

D. Send requests only from localhost and assume all origins are allowed

Solution

1. Step 1: Understand testing multiple origins

   To test multiple origins, you must simulate requests from each origin by setting the Origin header accordingly.

2. Step 2: Verify server response for each origin

   Check if Access-Control-Allow-Origin matches the requested origin or allows all origins (wildcard).

3. Final Answer:

   Send multiple requests with different Origin headers and check Access-Control-Allow-Origin in each response -> Option C

4. Quick Check:

   Test each origin with Origin header and check response [OK]

Hint: Test each origin separately by changing Origin header [OK]

Common Mistakes:

• Testing without Origin header
• Assuming localhost tests all origins
• Checking unrelated headers or response time