Security header validation in Postman - Test Execution Trace

Execution Trace Quiz - 3 Questions

Which step confirms the presence of the Content-Security-Policy header?

A Step 4: Verify 'Content-Security-Policy' header contains 'default-src 'self''

B Step 5: Check if 'X-Content-Type-Options' header is present

C Step 3: Check if 'Content-Security-Policy' header is present

D Step 6: Verify 'X-Content-Type-Options' header equals 'nosniff'

Practice

1. Which HTTP header is commonly used to prevent clickjacking attacks by controlling if a page can be displayed in a frame or iframe?

easy

A. Strict-Transport-Security

B. Content-Security-Policy

C. X-Frame-Options

D. Cache-Control

Solution

1. Step 1: Understand clickjacking protection

   Clickjacking is prevented by restricting framing of pages.

2. Step 2: Identify the header for frame control

   The X-Frame-Options header controls if a page can be framed.

3. Final Answer:

   X-Frame-Options -> Option C

4. Quick Check:

   Clickjacking protection = X-Frame-Options [OK]

Hint: Remember: Frame control = X-Frame-Options header [OK]

Common Mistakes:

• Confusing Content-Security-Policy with frame control
• Thinking Strict-Transport-Security controls framing
• Ignoring the role of X-Frame-Options

2. Which Postman test script correctly checks if the Content-Security-Policy header exists in the response?

easy

A. pm.test('CSP header present', () => pm.expect(pm.response.headers.get('Content-Security-Policy') !== null).to.be.true);

B. pm.test('CSP header present', () => pm.response.headers.has('content-security-policy') === false);

C. pm.test('CSP header present', () => pm.response.headers.get('Content-Security-Policy') === undefined);

D. pm.test('CSP header present', () => pm.response.headers.has('Content-Security-Policy'));

Solution

1. Step 1: Understand Postman header methods

   pm.response.headers.get() returns the header value or null if missing.

2. Step 2: Check for header existence correctly

   Checking if the value is not null confirms header presence.

3. Final Answer:

   pm.test('CSP header present', () => pm.expect(pm.response.headers.get('Content-Security-Policy') !== null).to.be.true); -> Option A

4. Quick Check:

   Header exists if get() !== null [OK]

Hint: Use get() !== null to check header presence [OK]

Common Mistakes:

• Using headers.has() which returns boolean but not tested properly
• Checking for undefined instead of null
• Negating the condition incorrectly

3. Given this Postman test code, what will be the test result if the response header X-Content-Type-Options is missing?

pm.test('X-Content-Type-Options header is set', () => {
  pm.response.to.have.header('X-Content-Type-Options');
});

medium

A. Test passes because header check is optional

B. Test passes but logs a warning

C. Test throws a syntax error

D. Test fails because header is missing

Solution

1. Step 1: Understand the assertion used

   pm.response.to.have.header() asserts the header must exist.

2. Step 2: Analyze missing header effect

   If the header is missing, the assertion fails and test fails.

3. Final Answer:

   Test fails because header is missing -> Option D

4. Quick Check:

   Missing required header = test failure [OK]

Hint: Required header missing causes test failure [OK]

Common Mistakes:

• Assuming test passes if header is missing
• Confusing syntax error with assertion failure
• Thinking warnings are logged instead of failure

4. Identify the error in this Postman test script that checks if the Strict-Transport-Security header includes max-age=31536000:

pm.test('HSTS max-age check', () => {
  pm.expect(pm.response.headers.get('Strict-Transport-Security')).to.include('max-age=31536000');
});

medium

A. Not checking if header exists before calling get()

B. Using to.include instead of to.have.string

C. Incorrect header name casing

D. Missing semicolon after pm.test

Solution

1. Step 1: Understand get() behavior when header missing

   If header is missing, get() returns null, causing error on to.include.

2. Step 2: Identify missing existence check

   Test should first check header exists before checking content.

3. Final Answer:

   Not checking if header exists before calling get() -> Option A

4. Quick Check:

   Check header presence before content check [OK]

Hint: Always verify header exists before content assertions [OK]

Common Mistakes:

• Assuming get() never returns null
• Ignoring null causing test errors
• Focusing on casing or semicolons instead

5. You want to write a Postman test to ensure the Content-Security-Policy header disallows inline scripts by including script-src 'self'. Which test script correctly validates this?

hard

A. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.get('Content-Security-Policy')).to.equal("script-src 'self'");
});

B. pm.test('CSP disallows inline scripts', () => {
const csp = pm.response.headers.get('Content-Security-Policy');
pm.expect(csp).to.include("script-src 'self'");
});

C. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.has('Content-Security-Policy')).to.be.true;
});

D. pm.test('CSP disallows inline scripts', () => {
pm.expect(pm.response.headers.get('Content-Security-Policy')).to.include('unsafe-inline');
});

Solution

1. Step 1: Understand CSP header content

   The header can contain multiple directives; we check if it includes script-src 'self'.

2. Step 2: Validate correct assertion method

   Using to.include checks if the string contains the directive, allowing other parts.

3. Final Answer:

   pm.test('CSP disallows inline scripts', () => { const csp = pm.response.headers.get('Content-Security-Policy'); pm.expect(csp).to.include("script-src 'self'"); }); -> Option B

4. Quick Check:

   Use include() to check partial CSP directive [OK]

Hint: Use include() to check CSP directives inside header string [OK]

Common Mistakes:

• Using to.equal which requires exact match
• Only checking header presence without content
• Checking for 'unsafe-inline' which allows inline scripts