Security header validation in Postman - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of security headers in HTTP responses?

Security headers help protect web applications by instructing browsers how to handle content securely, reducing risks like cross-site scripting and clickjacking.

beginner

Name three common security headers you should validate in API testing.

Common security headers include Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security.

intermediate

How can you validate security headers using Postman tests?

In Postman, you write test scripts that check if the response headers contain expected security headers with correct values using pm.response.headers.get().

beginner

What does the Strict-Transport-Security header do?

It tells browsers to only connect to the site using HTTPS for a specified time, preventing insecure HTTP connections.

intermediate

Why is it important to check the X-Content-Type-Options header?

This header prevents browsers from MIME-sniffing a response away from the declared content-type, reducing the risk of executing malicious files.

Which security header prevents your site from being embedded in iframes on other sites?

A X-Frame-Options

B Content-Security-Policy

C Strict-Transport-Security

D X-Content-Type-Options

X-Frame-Options controls whether your site can be displayed in frames or iframes, protecting against clickjacking.

In Postman, which method retrieves a response header value for validation?

A pm.response.body.get()

B pm.response.headers.get()

C pm.request.headers.get()

D pm.test.headers.get()

pm.response.headers.get() fetches the value of a specific header from the response.

What does the Content-Security-Policy header help prevent?

A Server crashes

B Slow network connections

C Password leaks

D Cross-site scripting attacks

Content-Security-Policy restricts sources of content, helping prevent cross-site scripting (XSS) attacks.

Which header enforces HTTPS connections by browsers?

A Strict-Transport-Security

B X-Frame-Options

C Content-Security-Policy

D X-Content-Type-Options

Strict-Transport-Security tells browsers to use HTTPS only for a set time period.

Why should you validate security headers in API responses?

A To improve API response speed

B To check API data format

C To ensure the API is secure against common web attacks

D To verify API authentication tokens

Validating security headers helps confirm the API applies protections against web security threats.

Explain how you would write a Postman test to check for the presence and correct value of the X-Frame-Options header.

Think about how to get header values and assert them in Postman test scripts.

Describe why security headers are important in web applications and what risks they help reduce.

Consider common web vulnerabilities and how headers can protect against them.