This step checks that a named HTTP response header contains a given string. Header lookup is case-insensitive, so Content-Type and content-type both work. The match is a substring check: the step passes as long as the actual header value includes the expected text anywhere within it. This makes it convenient for headers like Content-Type that often carry extra parameters (for example, application/json; charset=utf-8) - asserting "application/json" still passes even when the charset suffix is present.
Both the the response header and the header phrasings are accepted. The step can use either should be or should contain - both perform the same substring inclusion check, not an equality check, so choose whichever reads more naturally in context.
Accepted phrasings
Then the response header "Header-Name" should be "expected"
Then the response header "Header-Name" should contain "expected"
Then the header "Header-Name" should be "expected"
Then the header "Header-Name" should contain "expected"Examples
Then the response header "Content-Type" should be "application/json"
Then the header "Cache-Control" should contain "no-cache"
Then the response header "Content-Type" should contain "charset=utf-8"
Then the response header "Access-Control-Allow-Origin" should be "*"In a real scenario
Scenario: The users endpoint returns JSON with correct cache headers
Given the API base URL is "https://api.example.org/v1"
And I set header "Accept" with value "application/json"
When I send a GET request to "/users"
Then the API response code should be 200
And the response header "Content-Type" should contain "application/json"
And the header "Cache-Control" should contain "no-cache"
And the response header "Access-Control-Allow-Origin" should be "*"