8.4HTTP Headers

Headers carry metadata about the request and response. Several headers are critical for testing.

Request Headers to Set

Header	Purpose	Example
Content-Type	Format of request body	application/json
Authorization	Authentication credential	Bearer eyJhbG...
Accept	Desired response format	application/json
User-Agent	Client identification	Custom value for test identification

Response Headers to Verify

Header	What to Test
Content-Type	Matches expected format (wrong type causes silent failures)
Set-Cookie	Verify HttpOnly, Secure, SameSite attributes
Access-Control-Allow-Origin	CORS configuration correct for allowed domains
Cache-Control	Appropriate caching for the resource type
X-Request-ID	Present for traceability (useful for debugging)
Retry-After	Present on 429 responses
Location	Present on 201 (points to new resource) and 3xx redirects

def test_security_headers(api):
    r = api.get("/")
    # Security headers should be present
    assert "X-Content-Type-Options" in r.headers
    assert r.headers["X-Content-Type-Options"] == "nosniff"
    assert "X-Frame-Options" in r.headers
    assert "Strict-Transport-Security" in r.headers

def test_cors_headers(api):
    r = api.options("/api/users", headers={
        "Origin": "https://app.example.com",
        "Access-Control-Request-Method": "GET"
    })
    assert r.headers["Access-Control-Allow-Origin"] in [
        "https://app.example.com", "*"
    ]