Security header validation in Postman - Build an Automation Script

Validate security headers in API response

Preconditions (2)

Step 1: Send a GET request to the API endpoint https://api.example.com/data

Step 2: Inspect the response headers

Step 3: Verify that the following security headers are present:

Step 4: - Content-Security-Policy

Step 5: - X-Content-Type-Options

Step 6: - Strict-Transport-Security

Step 7: - X-Frame-Options

Step 8: - Referrer-Policy

Step 9: Verify that each header has the expected value:

Step 10: - Content-Security-Policy: default-src 'self'

Step 11: - X-Content-Type-Options: nosniff

Step 12: - Strict-Transport-Security: max-age=31536000; includeSubDomains

Step 13: - X-Frame-Options: DENY

Step 14: - Referrer-Policy: no-referrer

✅ Expected Result: All listed security headers are present in the response with the exact expected values.

Automation Requirements - Postman Tests (JavaScript)

Assertions Needed:

Response headers contain Content-Security-Policy with value "default-src 'self'"

Response headers contain X-Content-Type-Options with value "nosniff"

Response headers contain Strict-Transport-Security with value "max-age=31536000; includeSubDomains"

Response headers contain X-Frame-Options with value "DENY"

Response headers contain Referrer-Policy with value "no-referrer"

Best Practices:

Use pm.response.headers.get() to access headers

Use strict equality checks for header values

Write clear assertion messages

Keep test code readable and maintainable

Automated Solution

Postman

pm.test('Validate Content-Security-Policy header', () => {
    const csp = pm.response.headers.get('Content-Security-Policy');
    pm.expect(csp).to.eql("default-src 'self'");
});

pm.test('Validate X-Content-Type-Options header', () => {
    const xcto = pm.response.headers.get('X-Content-Type-Options');
    pm.expect(xcto).to.eql('nosniff');
});

pm.test('Validate Strict-Transport-Security header', () => {
    const sts = pm.response.headers.get('Strict-Transport-Security');
    pm.expect(sts).to.eql('max-age=31536000; includeSubDomains');
});

pm.test('Validate X-Frame-Options header', () => {
    const xfo = pm.response.headers.get('X-Frame-Options');
    pm.expect(xfo).to.eql('DENY');
});

pm.test('Validate Referrer-Policy header', () => {
    const rp = pm.response.headers.get('Referrer-Policy');
    pm.expect(rp).to.eql('no-referrer');
});

This Postman test script checks each required security header individually.

Each pm.test block names the header it validates for clarity.

We use pm.response.headers.get() to get the header value by name.

The pm.expect(...).to.eql(...) assertion checks that the header value exactly matches the expected string.

This approach ensures clear, maintainable tests that will fail if any header is missing or has an incorrect value.

Common Mistakes - 4 Pitfalls

Using case-sensitive header names incorrectly

Using loose equality (==) instead of strict equality (=== or to.eql)

Not checking for header presence before asserting value

Hardcoding header values without verifying actual server response

Bonus Challenge

Now add data-driven testing with 3 different API endpoints to validate security headers on each.

Show Hint

Practice

1. Which HTTP header is commonly used to prevent clickjacking attacks by controlling if a page can be displayed in a frame or iframe?

easy

A. Strict-Transport-Security

B. Content-Security-Policy

C. X-Frame-Options

D. Cache-Control

Solution

1. Step 1: Understand clickjacking protection

   Clickjacking is prevented by restricting framing of pages.

2. Step 2: Identify the header for frame control

   The X-Frame-Options header controls if a page can be framed.

3. Final Answer:

   X-Frame-Options -> Option C

4. Quick Check:

   Clickjacking protection = X-Frame-Options [OK]

Hint: Remember: Frame control = X-Frame-Options header [OK]

Common Mistakes:

• Confusing Content-Security-Policy with frame control
• Thinking Strict-Transport-Security controls framing
• Ignoring the role of X-Frame-Options

2. Which Postman test script correctly checks if the Content-Security-Policy header exists in the response?

easy

A. pm.test('CSP header present', () => pm.expect(pm.response.headers.get('Content-Security-Policy') !== null).to.be.true);

B. pm.test('CSP header present', () => pm.response.headers.has('content-security-policy') === false);

C. pm.test('CSP header present', () => pm.response.headers.get('Content-Security-Policy') === undefined);

D. pm.test('CSP header present', () => pm.response.headers.has('Content-Security-Policy'));

Solution

1. Step 1: Understand Postman header methods

   pm.response.headers.get() returns the header value or null if missing.

2. Step 2: Check for header existence correctly

   Checking if the value is not null confirms header presence.

3. Final Answer:

   pm.test('CSP header present', () => pm.expect(pm.response.headers.get('Content-Security-Policy') !== null).to.be.true); -> Option A

4. Quick Check:

   Header exists if get() !== null [OK]

Hint: Use get() !== null to check header presence [OK]

Common Mistakes:

• Using headers.has() which returns boolean but not tested properly
• Checking for undefined instead of null
• Negating the condition incorrectly

3. Given this Postman test code, what will be the test result if the response header X-Content-Type-Options is missing?

pm.test('X-Content-Type-Options header is set', () => {
  pm.response.to.have.header('X-Content-Type-Options');
});

medium

A. Test passes because header check is optional

B. Test passes but logs a warning

C. Test throws a syntax error

D. Test fails because header is missing

Solution

1. Step 1: Understand the assertion used

   pm.response.to.have.header() asserts the header must exist.

2. Step 2: Analyze missing header effect

   If the header is missing, the assertion fails and test fails.

3. Final Answer:

   Test fails because header is missing -> Option D

4. Quick Check:

   Missing required header = test failure [OK]

Hint: Required header missing causes test failure [OK]

Common Mistakes:

• Assuming test passes if header is missing
• Confusing syntax error with assertion failure
• Thinking warnings are logged instead of failure

4. Identify the error in this Postman test script that checks if the Strict-Transport-Security header includes max-age=31536000:

pm.test('HSTS max-age check', () => {
  pm.expect(pm.response.headers.get('Strict-Transport-Security')).to.include('max-age=31536000');
});

medium

A. Not checking if header exists before calling get()

B. Using to.include instead of to.have.string

C. Incorrect header name casing

D. Missing semicolon after pm.test

Solution

1. Step 1: Understand get() behavior when header missing

   If header is missing, get() returns null, causing error on to.include.

2. Step 2: Identify missing existence check

   Test should first check header exists before checking content.

3. Final Answer:

   Not checking if header exists before calling get() -> Option A

4. Quick Check:

   Check header presence before content check [OK]

Hint: Always verify header exists before content assertions [OK]

Common Mistakes:

• Assuming get() never returns null
• Ignoring null causing test errors
• Focusing on casing or semicolons instead

5. You want to write a Postman test to ensure the Content-Security-Policy header disallows inline scripts by including script-src 'self'. Which test script correctly validates this?

hard

A. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.get('Content-Security-Policy')).to.equal("script-src 'self'");
});

B. pm.test('CSP disallows inline scripts', () => {
const csp = pm.response.headers.get('Content-Security-Policy');
pm.expect(csp).to.include("script-src 'self'");
});

C. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.has('Content-Security-Policy')).to.be.true;
});

D. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.get('Content-Security-Policy')).to.include('unsafe-inline');
});

Solution

1. Step 1: Understand CSP header content

   The header can contain multiple directives; we check if it includes script-src 'self'.

2. Step 2: Validate correct assertion method

   Using to.include checks if the string contains the directive, allowing other parts.

3. Final Answer:

   pm.test('CSP disallows inline scripts', () => { const csp = pm.response.headers.get('Content-Security-Policy'); pm.expect(csp).to.include("script-src 'self'"); }); -> Option B

4. Quick Check:

   Use include() to check partial CSP directive [OK]

Hint: Use include() to check CSP directives inside header string [OK]

Common Mistakes:

• Using to.equal which requires exact match
• Only checking header presence without content
• Checking for 'unsafe-inline' which allows inline scripts