Security header validation in Postman - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ assertion

intermediate

Validate Content-Security-Policy Header Presence

You want to write a Postman test to check if the Content-Security-Policy header is present in the response.

Which assertion code snippet correctly verifies this?

A pm.test('Content-Security-Policy header is present', () => { pm.response.to.have.header('Content-Security-Policy'); });

B pm.test('Content-Security-Policy header is present', () => { pm.response.headers.has('Content-Security-Policy'); });

C pm.test('Content-Security-Policy header is present', () => { pm.expect(pm.response.headers.get('Content-Security-Policy')).to.exist; });

D pm.test('Content-Security-Policy header is present', () => { pm.response.to.have.property('Content-Security-Policy'); });

💡 Hint

Use Postman's built-in assertion methods to check headers.

Option A uses pm.response.to.have.header(), which is the correct way to assert header presence in Postman tests.

Option A calls has() but does not assert the result, so it won't fail the test if missing.

Option A tries to access headers like an object, which is invalid in Postman.

Option A uses to.have.property() which is not valid for headers.

❓ Predict Output

intermediate

Output of Postman Test Checking X-Frame-Options Value

What is the test result when running this Postman test if the response header X-Frame-Options has the value DENY?

pm.test('X-Frame-Options is DENY', () => {
  pm.expect(pm.response.headers.get('X-Frame-Options')).to.eql('DENY');
});

Postman

pm.test('X-Frame-Options is DENY', () => {
  pm.expect(pm.response.headers.get('X-Frame-Options')).to.eql('DENY');
});

A Test throws TypeError

B Test fails with AssertionError

C Test passes successfully

D Test is skipped

💡 Hint

Check if the header value matches exactly.

The test compares the header value to 'DENY'. If the header value is exactly 'DENY', the test passes.

If the value differs, it fails with an AssertionError.

🔧 Debug

advanced

Identify the Error in Postman Test for Strict-Transport-Security

Review this Postman test code snippet. It is intended to check if the Strict-Transport-Security header contains max-age=31536000. What error will occur when running this test?

pm.test('HSTS max-age check', () => {
  const hsts = pm.response.headers.get('Strict-Transport-Security');
  pm.expect(hsts.includes('max-age=31536000')).to.be.true;
});

Postman

pm.test('HSTS max-age check', () => {
  const hsts = pm.response.headers.get('Strict-Transport-Security');
  pm.expect(hsts.includes('max-age=31536000')).to.be.true;
});

A TypeError: Cannot read property 'includes' of null

B No error, test passes

C SyntaxError: Unexpected token '.'

D AssertionError: expected false to be true

💡 Hint

Consider what happens if the header is missing.

If the header Strict-Transport-Security is missing, pm.response.headers.get() returns null.

Calling includes() on null causes a TypeError.

🧠 Conceptual

advanced

Best Practice for Validating Multiple Security Headers in Postman

You want to validate that the response contains these security headers with correct values:

• Content-Security-Policy: default-src 'self'
• X-Content-Type-Options: nosniff
• Referrer-Policy: no-referrer

Which approach is best to write these validations in Postman tests?

A Write a single assertion that checks if the response headers object has length 3

B Write one <code>pm.test</code> block that asserts all headers together using multiple <code>pm.expect</code> calls

C Check only one header and assume others are correct

D Write separate <code>pm.test</code> blocks for each header with specific assertions

💡 Hint

Think about clarity and test reporting.

Writing separate pm.test blocks for each header makes it clear which header fails if any.

Option D works but is less clear in reports.

Option D is incomplete testing.

Option D only checks count, not values.

❓ framework

expert

Automating Security Header Validation Across Multiple Environments in Postman

You have multiple environments (dev, staging, production) with different base URLs. You want to automate security header validation tests in Postman so they run on all environments without duplicating test scripts.

Which method best achieves this goal?

A Manually run tests in each environment and save separate collections for each

B Use Postman Collection variables for base URLs and write tests once in the collection's test scripts

C Copy the same test scripts into each environment's pre-request scripts

D Write environment-specific tests inside each request's test tab

💡 Hint

Think about reusability and maintainability.

Using collection variables for base URLs allows writing tests once and running them across environments by switching variables.

Copying or duplicating scripts increases maintenance effort and risk of inconsistency.

Practice

1. Which HTTP header is commonly used to prevent clickjacking attacks by controlling if a page can be displayed in a frame or iframe?

easy

A. Strict-Transport-Security

B. Content-Security-Policy

C. X-Frame-Options

D. Cache-Control

Solution

1. Step 1: Understand clickjacking protection

   Clickjacking is prevented by restricting framing of pages.

2. Step 2: Identify the header for frame control

   The X-Frame-Options header controls if a page can be framed.

3. Final Answer:

   X-Frame-Options -> Option C

4. Quick Check:

   Clickjacking protection = X-Frame-Options [OK]

Hint: Remember: Frame control = X-Frame-Options header [OK]

Common Mistakes:

• Confusing Content-Security-Policy with frame control
• Thinking Strict-Transport-Security controls framing
• Ignoring the role of X-Frame-Options

2. Which Postman test script correctly checks if the Content-Security-Policy header exists in the response?

easy

A. pm.test('CSP header present', () => pm.expect(pm.response.headers.get('Content-Security-Policy') !== null).to.be.true);

B. pm.test('CSP header present', () => pm.response.headers.has('content-security-policy') === false);

C. pm.test('CSP header present', () => pm.response.headers.get('Content-Security-Policy') === undefined);

D. pm.test('CSP header present', () => pm.response.headers.has('Content-Security-Policy'));

Solution

1. Step 1: Understand Postman header methods

   pm.response.headers.get() returns the header value or null if missing.

2. Step 2: Check for header existence correctly

   Checking if the value is not null confirms header presence.

3. Final Answer:

   pm.test('CSP header present', () => pm.expect(pm.response.headers.get('Content-Security-Policy') !== null).to.be.true); -> Option A

4. Quick Check:

   Header exists if get() !== null [OK]

Hint: Use get() !== null to check header presence [OK]

Common Mistakes:

• Using headers.has() which returns boolean but not tested properly
• Checking for undefined instead of null
• Negating the condition incorrectly

3. Given this Postman test code, what will be the test result if the response header X-Content-Type-Options is missing?

pm.test('X-Content-Type-Options header is set', () => {
  pm.response.to.have.header('X-Content-Type-Options');
});

medium

A. Test passes because header check is optional

B. Test passes but logs a warning

C. Test throws a syntax error

D. Test fails because header is missing

Solution

1. Step 1: Understand the assertion used

   pm.response.to.have.header() asserts the header must exist.

2. Step 2: Analyze missing header effect

   If the header is missing, the assertion fails and test fails.

3. Final Answer:

   Test fails because header is missing -> Option D

4. Quick Check:

   Missing required header = test failure [OK]

Hint: Required header missing causes test failure [OK]

Common Mistakes:

• Assuming test passes if header is missing
• Confusing syntax error with assertion failure
• Thinking warnings are logged instead of failure

4. Identify the error in this Postman test script that checks if the Strict-Transport-Security header includes max-age=31536000:

pm.test('HSTS max-age check', () => {
  pm.expect(pm.response.headers.get('Strict-Transport-Security')).to.include('max-age=31536000');
});

medium

A. Not checking if header exists before calling get()

B. Using to.include instead of to.have.string

C. Incorrect header name casing

D. Missing semicolon after pm.test

Solution

1. Step 1: Understand get() behavior when header missing

   If header is missing, get() returns null, causing error on to.include.

2. Step 2: Identify missing existence check

   Test should first check header exists before checking content.

3. Final Answer:

   Not checking if header exists before calling get() -> Option A

4. Quick Check:

   Check header presence before content check [OK]

Hint: Always verify header exists before content assertions [OK]

Common Mistakes:

• Assuming get() never returns null
• Ignoring null causing test errors
• Focusing on casing or semicolons instead

5. You want to write a Postman test to ensure the Content-Security-Policy header disallows inline scripts by including script-src 'self'. Which test script correctly validates this?

hard

A. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.get('Content-Security-Policy')).to.equal("script-src 'self'");
});

B. pm.test('CSP disallows inline scripts', () => {
const csp = pm.response.headers.get('Content-Security-Policy');
pm.expect(csp).to.include("script-src 'self'");
});

C. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.has('Content-Security-Policy')).to.be.true;
});

D. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.get('Content-Security-Policy')).to.include('unsafe-inline');
});

Solution

1. Step 1: Understand CSP header content

   The header can contain multiple directives; we check if it includes script-src 'self'.

2. Step 2: Validate correct assertion method

   Using to.include checks if the string contains the directive, allowing other parts.

3. Final Answer:

   pm.test('CSP disallows inline scripts', () => { const csp = pm.response.headers.get('Content-Security-Policy'); pm.expect(csp).to.include("script-src 'self'"); }); -> Option B

4. Quick Check:

   Use include() to check partial CSP directive [OK]

Hint: Use include() to check CSP directives inside header string [OK]

Common Mistakes:

• Using to.equal which requires exact match
• Only checking header presence without content
• Checking for 'unsafe-inline' which allows inline scripts