Security header validation in Postman - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check if the 'Strict-Transport-Security' header is present in the response.

Postman

pm.test('Check HSTS header presence', () => {
    pm.response.to.have.header([1]);
});

Drag options to blanks, or click blank then click option'

A'Content-Security-Policy'

B'X-Frame-Options'

C'Strict-Transport-Security'

D'X-Content-Type-Options'

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different security header name.

Forgetting to include quotes around the header name.

The 'Strict-Transport-Security' header enforces secure (HTTPS) connections. This test checks if it is present.

2fill in blank

medium

Complete the code to assert that the 'X-Frame-Options' header value equals 'DENY'.

Postman

pm.test('X-Frame-Options is DENY', () => {
    pm.response.to.have.header('X-Frame-Options');
    pm.expect(pm.response.headers.get('X-Frame-Options')).to.eql([1]);
});

Drag options to blanks, or click blank then click option'

A'NO-CACHE'

B'ALLOW-FROM https://example.com'

C'SAMEORIGIN'

D'DENY'

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'SAMEORIGIN' instead of 'DENY'.

Using an invalid header value.

The 'X-Frame-Options' header with value 'DENY' prevents the page from being framed, protecting against clickjacking.

3fill in blank

hard

Fix the error in the code to correctly check that the 'Content-Security-Policy' header contains 'default-src'.

Postman

pm.test('Content-Security-Policy contains default-src', () => {
    const csp = pm.response.headers.get([1]);
    pm.expect(csp).to.include('default-src');
});

Drag options to blanks, or click blank then click option'

A'Content-Security-Policy'

BContent-Security-Policy

C'content-security-policy'

D'Content_Security_Policy'

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting quotes around the header name.

Using underscores instead of dashes.

Incorrect casing in header name.

The header name must be a string with exact casing and dashes as in 'Content-Security-Policy'.

4fill in blank

hard

Fill both blanks to test that the 'X-Content-Type-Options' header exists and equals 'nosniff'.

Postman

pm.test('X-Content-Type-Options header check', () => {
    pm.response.to.have.header([1]);
    pm.expect(pm.response.headers.get([2])).to.eql('nosniff');
});

Drag options to blanks, or click blank then click option'

A'X-Content-Type-Options'

B'nosniff'

D'no-sniff'

Attempts:

3 left

💡 Hint

Common Mistakes

Using the header value instead of the header name in the first blank.

Misspelling the header name.

Using 'no-sniff' instead of 'nosniff'.

Both blanks require the exact header name as a string to check presence and value.

5fill in blank

hard

Fill all three blanks to create a test that verifies the 'Referrer-Policy' header exists, its value is stored in a variable, and asserts it equals 'no-referrer'.

Postman

pm.test('Referrer-Policy header validation', () => {
    pm.response.to.have.header([1]);
    const refPolicy = pm.response.headers.get([2]);
    pm.expect(refPolicy).to.eql([3]);
});

Drag options to blanks, or click blank then click option'

A'Referrer-Policy'

B'no-referrer'

D'no-referrer-policy'

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up header name and value in blanks.

Using incorrect header value like 'no-referrer-policy'.

Omitting quotes around strings.

The first blank must be the header name string, the second blank the same header name string, and the third blank the expected value string 'no-referrer'.

Practice

1. Which HTTP header is commonly used to prevent clickjacking attacks by controlling if a page can be displayed in a frame or iframe?

easy

A. Strict-Transport-Security

B. Content-Security-Policy

C. X-Frame-Options

D. Cache-Control

Solution

1. Step 1: Understand clickjacking protection

   Clickjacking is prevented by restricting framing of pages.

2. Step 2: Identify the header for frame control

   The X-Frame-Options header controls if a page can be framed.

3. Final Answer:

   X-Frame-Options -> Option C

4. Quick Check:

   Clickjacking protection = X-Frame-Options [OK]

Hint: Remember: Frame control = X-Frame-Options header [OK]

Common Mistakes:

• Confusing Content-Security-Policy with frame control
• Thinking Strict-Transport-Security controls framing
• Ignoring the role of X-Frame-Options

2. Which Postman test script correctly checks if the Content-Security-Policy header exists in the response?

easy

A. pm.test('CSP header present', () => pm.expect(pm.response.headers.get('Content-Security-Policy') !== null).to.be.true);

B. pm.test('CSP header present', () => pm.response.headers.has('content-security-policy') === false);

C. pm.test('CSP header present', () => pm.response.headers.get('Content-Security-Policy') === undefined);

D. pm.test('CSP header present', () => pm.response.headers.has('Content-Security-Policy'));

Solution

1. Step 1: Understand Postman header methods

   pm.response.headers.get() returns the header value or null if missing.

2. Step 2: Check for header existence correctly

   Checking if the value is not null confirms header presence.

3. Final Answer:

   pm.test('CSP header present', () => pm.expect(pm.response.headers.get('Content-Security-Policy') !== null).to.be.true); -> Option A

4. Quick Check:

   Header exists if get() !== null [OK]

Hint: Use get() !== null to check header presence [OK]

Common Mistakes:

• Using headers.has() which returns boolean but not tested properly
• Checking for undefined instead of null
• Negating the condition incorrectly

3. Given this Postman test code, what will be the test result if the response header X-Content-Type-Options is missing?

pm.test('X-Content-Type-Options header is set', () => {
  pm.response.to.have.header('X-Content-Type-Options');
});

medium

A. Test passes because header check is optional

B. Test passes but logs a warning

C. Test throws a syntax error

D. Test fails because header is missing

Solution

1. Step 1: Understand the assertion used

   pm.response.to.have.header() asserts the header must exist.

2. Step 2: Analyze missing header effect

   If the header is missing, the assertion fails and test fails.

3. Final Answer:

   Test fails because header is missing -> Option D

4. Quick Check:

   Missing required header = test failure [OK]

Hint: Required header missing causes test failure [OK]

Common Mistakes:

• Assuming test passes if header is missing
• Confusing syntax error with assertion failure
• Thinking warnings are logged instead of failure

4. Identify the error in this Postman test script that checks if the Strict-Transport-Security header includes max-age=31536000:

pm.test('HSTS max-age check', () => {
  pm.expect(pm.response.headers.get('Strict-Transport-Security')).to.include('max-age=31536000');
});

medium

A. Not checking if header exists before calling get()

B. Using to.include instead of to.have.string

C. Incorrect header name casing

D. Missing semicolon after pm.test

Solution

1. Step 1: Understand get() behavior when header missing

   If header is missing, get() returns null, causing error on to.include.

2. Step 2: Identify missing existence check

   Test should first check header exists before checking content.

3. Final Answer:

   Not checking if header exists before calling get() -> Option A

4. Quick Check:

   Check header presence before content check [OK]

Hint: Always verify header exists before content assertions [OK]

Common Mistakes:

• Assuming get() never returns null
• Ignoring null causing test errors
• Focusing on casing or semicolons instead

5. You want to write a Postman test to ensure the Content-Security-Policy header disallows inline scripts by including script-src 'self'. Which test script correctly validates this?

hard

A. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.get('Content-Security-Policy')).to.equal("script-src 'self'");
});

B. pm.test('CSP disallows inline scripts', () => {
const csp = pm.response.headers.get('Content-Security-Policy');
pm.expect(csp).to.include("script-src 'self'");
});

C. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.has('Content-Security-Policy')).to.be.true;
});

D. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.get('Content-Security-Policy')).to.include('unsafe-inline');
});

Solution

1. Step 1: Understand CSP header content

   The header can contain multiple directives; we check if it includes script-src 'self'.

2. Step 2: Validate correct assertion method

   Using to.include checks if the string contains the directive, allowing other parts.

3. Final Answer:

   pm.test('CSP disallows inline scripts', () => { const csp = pm.response.headers.get('Content-Security-Policy'); pm.expect(csp).to.include("script-src 'self'"); }); -> Option B

4. Quick Check:

   Use include() to check partial CSP directive [OK]

Hint: Use include() to check CSP directives inside header string [OK]

Common Mistakes:

• Using to.equal which requires exact match
• Only checking header presence without content
• Checking for 'unsafe-inline' which allows inline scripts