Security header validation in Postman - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check if the 'Strict-Transport-Security' header is present in the response.

Postman

pm.test('Check HSTS header presence', () => {
    pm.response.to.have.header([1]);
});

Drag options to blanks, or click blank then click option'

A'Content-Security-Policy'

B'X-Frame-Options'

C'Strict-Transport-Security'

D'X-Content-Type-Options'

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different security header name.

Forgetting to include quotes around the header name.

The 'Strict-Transport-Security' header enforces secure (HTTPS) connections. This test checks if it is present.

2fill in blank

medium

Complete the code to assert that the 'X-Frame-Options' header value equals 'DENY'.

Postman

pm.test('X-Frame-Options is DENY', () => {
    pm.response.to.have.header('X-Frame-Options');
    pm.expect(pm.response.headers.get('X-Frame-Options')).to.eql([1]);
});

Drag options to blanks, or click blank then click option'

A'NO-CACHE'

B'ALLOW-FROM https://example.com'

C'SAMEORIGIN'

D'DENY'

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'SAMEORIGIN' instead of 'DENY'.

Using an invalid header value.

The 'X-Frame-Options' header with value 'DENY' prevents the page from being framed, protecting against clickjacking.

3fill in blank

hard

Fix the error in the code to correctly check that the 'Content-Security-Policy' header contains 'default-src'.

Postman

pm.test('Content-Security-Policy contains default-src', () => {
    const csp = pm.response.headers.get([1]);
    pm.expect(csp).to.include('default-src');
});

Drag options to blanks, or click blank then click option'

A'Content-Security-Policy'

BContent-Security-Policy

C'content-security-policy'

D'Content_Security_Policy'

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting quotes around the header name.

Using underscores instead of dashes.

Incorrect casing in header name.

The header name must be a string with exact casing and dashes as in 'Content-Security-Policy'.

4fill in blank

hard

Fill both blanks to test that the 'X-Content-Type-Options' header exists and equals 'nosniff'.

Postman

pm.test('X-Content-Type-Options header check', () => {
    pm.response.to.have.header([1]);
    pm.expect(pm.response.headers.get([2])).to.eql('nosniff');
});

Drag options to blanks, or click blank then click option'

A'X-Content-Type-Options'

B'nosniff'

D'no-sniff'

Attempts:

3 left

💡 Hint

Common Mistakes

Using the header value instead of the header name in the first blank.

Misspelling the header name.

Using 'no-sniff' instead of 'nosniff'.

Both blanks require the exact header name as a string to check presence and value.

5fill in blank

hard

Fill all three blanks to create a test that verifies the 'Referrer-Policy' header exists, its value is stored in a variable, and asserts it equals 'no-referrer'.

Postman

pm.test('Referrer-Policy header validation', () => {
    pm.response.to.have.header([1]);
    const refPolicy = pm.response.headers.get([2]);
    pm.expect(refPolicy).to.eql([3]);
});

Drag options to blanks, or click blank then click option'

A'Referrer-Policy'

B'no-referrer'

D'no-referrer-policy'

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up header name and value in blanks.

Using incorrect header value like 'no-referrer-policy'.

Omitting quotes around strings.

The first blank must be the header name string, the second blank the same header name string, and the third blank the expected value string 'no-referrer'.