Security header validation in Postman - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ assertion

intermediate

Validate Content-Security-Policy Header Presence

You want to write a Postman test to check if the Content-Security-Policy header is present in the response.

Which assertion code snippet correctly verifies this?

A pm.test('Content-Security-Policy header is present', () => { pm.response.to.have.header('Content-Security-Policy'); });

B pm.test('Content-Security-Policy header is present', () => { pm.response.headers.has('Content-Security-Policy'); });

C pm.test('Content-Security-Policy header is present', () => { pm.expect(pm.response.headers.get('Content-Security-Policy')).to.exist; });

D pm.test('Content-Security-Policy header is present', () => { pm.response.to.have.property('Content-Security-Policy'); });

💡 Hint

Use Postman's built-in assertion methods to check headers.

Option A uses pm.response.to.have.header(), which is the correct way to assert header presence in Postman tests.

Option A calls has() but does not assert the result, so it won't fail the test if missing.

Option A tries to access headers like an object, which is invalid in Postman.

Option A uses to.have.property() which is not valid for headers.

❓ Predict Output

intermediate

Output of Postman Test Checking X-Frame-Options Value

What is the test result when running this Postman test if the response header X-Frame-Options has the value DENY?

pm.test('X-Frame-Options is DENY', () => {
  pm.expect(pm.response.headers.get('X-Frame-Options')).to.eql('DENY');
});

Postman

pm.test('X-Frame-Options is DENY', () => {
  pm.expect(pm.response.headers.get('X-Frame-Options')).to.eql('DENY');
});

A Test throws TypeError

B Test fails with AssertionError

C Test passes successfully

D Test is skipped

💡 Hint

Check if the header value matches exactly.

The test compares the header value to 'DENY'. If the header value is exactly 'DENY', the test passes.

If the value differs, it fails with an AssertionError.

🔧 Debug

advanced

Identify the Error in Postman Test for Strict-Transport-Security

Review this Postman test code snippet. It is intended to check if the Strict-Transport-Security header contains max-age=31536000. What error will occur when running this test?

pm.test('HSTS max-age check', () => {
  const hsts = pm.response.headers.get('Strict-Transport-Security');
  pm.expect(hsts.includes('max-age=31536000')).to.be.true;
});

Postman

pm.test('HSTS max-age check', () => {
  const hsts = pm.response.headers.get('Strict-Transport-Security');
  pm.expect(hsts.includes('max-age=31536000')).to.be.true;
});

A TypeError: Cannot read property 'includes' of null

B No error, test passes

C SyntaxError: Unexpected token '.'

D AssertionError: expected false to be true

💡 Hint

Consider what happens if the header is missing.

If the header Strict-Transport-Security is missing, pm.response.headers.get() returns null.

Calling includes() on null causes a TypeError.

🧠 Conceptual

advanced

Best Practice for Validating Multiple Security Headers in Postman

You want to validate that the response contains these security headers with correct values:

• Content-Security-Policy: default-src 'self'
• X-Content-Type-Options: nosniff
• Referrer-Policy: no-referrer

Which approach is best to write these validations in Postman tests?

A Write a single assertion that checks if the response headers object has length 3

B Write one <code>pm.test</code> block that asserts all headers together using multiple <code>pm.expect</code> calls

C Check only one header and assume others are correct

D Write separate <code>pm.test</code> blocks for each header with specific assertions

💡 Hint

Think about clarity and test reporting.

Writing separate pm.test blocks for each header makes it clear which header fails if any.

Option D works but is less clear in reports.

Option D is incomplete testing.

Option D only checks count, not values.

❓ framework

expert

Automating Security Header Validation Across Multiple Environments in Postman

You have multiple environments (dev, staging, production) with different base URLs. You want to automate security header validation tests in Postman so they run on all environments without duplicating test scripts.

Which method best achieves this goal?

A Manually run tests in each environment and save separate collections for each

B Use Postman Collection variables for base URLs and write tests once in the collection's test scripts

C Copy the same test scripts into each environment's pre-request scripts

D Write environment-specific tests inside each request's test tab

💡 Hint

Think about reusability and maintainability.

Using collection variables for base URLs allows writing tests once and running them across environments by switching variables.

Copying or duplicating scripts increases maintenance effort and risk of inconsistency.