How Do I Authenticate an API Request Using a Token With Postman

1
votes

I am trying to test a Web API using Postman on a project which I have inherited from previous developers. All I know so far is that Authentication has been configured using ASP.Net Identity and Identity Server 4.0 which implements OAuth and issues short lived JSON Web Tokens (JWT) and Refresh Tokens.

If I navigate to the development website, log in (successfully), and use Chrome Developer Tools to inspect the initial log in request I can see that the body of the request contains a Form with 3 fields; userName, password and returnUrl. If I right-click on the request I can copy the request as cURL (bash) and in Postman I can import the data to create a new request. If I send the request I get a status 200 OK back and the response includes 6 cookies. However the body of the response contains an htlm page which Postman can't render and a message You need to enable JavaScript to run this app.

I'm lost now as to how I can use the response to authenticate a request for some data. Is the Token I need contained within one of the cookies? How do I extract the Token and use it within a request for some data? Any advice or suggestions would be very welcome.

1
jwtpostmanidentityserver4

1 Answers

0
votes

Normally, with JavaScript enabled in the browser, <form> would be automatically posted to its' destination defined in action, using method. JavaScript would do somethign like the following:

window.addEventListener('load', function(){document.forms[0].submit();});

So without JavaScript, you would need to somehow parse the form that you received and recreate equivalent request.

The form, received upon successful login, contains data that should be sent back to your origin website, to authenticate the end-user.

For example, form's body contains hidden input fields, defined by OpenID protocol:

...
<input type='hidden' name='token_type' value='Bearer' />
<input type='hidden' name='expires_in' value='600' />
...

Form action attribute points back to sign-in endpoint on your website. For example:

<form method='post' action='https://{hostname:post}/signin-oidc'>