Echo Request Headers

How it works

Request headers are how a client describes itself and its call: credentials, tracing ids, feature flags, client versions. In REST Assured you add one with header(name, value) on the request specification, and you can chain as many calls as you need before the verb.

Even without any of yours, REST Assured sends a few headers of its own. Echoed back by testkru, a bare request shows Accept set to a wildcard, an Accept-Encoding for gzip, and a User-Agent naming Apache HttpClient 4.5.13 and the Java version. The /headers/echo endpoint returns every header it received inside a headers object, with each name upper-cased because that is how PHP stores them.

Two calls with the same custom name both go out by default; REST Assured keeps them as two values. Accept and Content-Type are the exceptions: a second call replaces the first. Note that this echo server keeps only the last value of a duplicated name in its reply.

About the assignment

Send two custom headers to the echo endpoint and confirm the server received both values, using the upper-case names it reports them under.

What you will do

1. 1Start from given() and add the X-Custom-Header and X-Framework headers with the values from the starter comment, one header() call each.
2. 2GET /headers/echo and keep the Response.
3. 3Pull the headers object out as a Map with getMap().
4. 4Look up the two upper-case keys and print them after Custom Header: and Framework:.

Common mistakes

• Looking up the original spelling

  The map returned by getMap() is a plain Java map, and its keys are case-sensitive. Asking for X-Custom-Header returns null. Use the upper-case form the server sends back.

• Expecting header() to replace a value

  Calling header() twice with one name keeps both values in the request. If you meant to override, build the request once, or change the header config for that name.

• Leaking secret headers into logs

  Once you add log().all(), every header is printed. A real token or API key sent as a header lands in CI logs unless you blacklist it.

In a real test suite

Related lessons

• Custom Response HeadersReads headers the server sets on its response.
• API Key AuthenticationA real use for a custom request header: an X-API-Key credential.
• Headers SpecificationMoves shared request headers into a reusable specification.

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import static io.restassured.RestAssured.*;
import java.util.Map;

public class Main {
    public static void main(String[] args) {
        RestAssured.baseURI = "https://testkru.com/api";

        // TODO: GET /headers/echo with two headers:
        //   "X-Custom-Header" = "TestValue123"
        //   "X-Framework" = "REST Assured"
        // TODO: Extract the echoed headers from response
        // HINT: response.jsonPath().getMap("headers") returns all headers as a Map
        // Header names are uppercased: "X-CUSTOM-HEADER", "X-FRAMEWORK"
    }
}