{
"data": [
{
"type": "blog",
"id": "blog/2022/postman-automatic-jwt-authentication-with-expired-token-refresh",
"url": "https://ktherage.github.io/blog/2022/postman-automatic-jwt-authentication-with-expired-token-refresh/",
"attributes": {
"alias": "/blog/postman-automatic-jwt-authentication-with-expired-token-refresh/",
"title": "Postman : Automatic JWT authentication with expired token refresh",
"date": "2022-12-20T00:00:00+00:00",
"description": "A quick and simple way to test the performance of your HTTP calls.",
"cover": {"image":"img/padlock-fence.jpg","alt":"Silver padlocks on green steel fence","caption":"Photo by Frank McIntyre on Pexels"},
"published": true,
"tags": ["Postman","Authentication","API","JavaScript"],
"excerpt": "You've always wondered how to get automatically authenticated toward your JWT API. I'll tell you how I achieved this in this article.",
"body": "Youβve always wondered how to get automatically authenticated toward your JWT API. Iβll tell you how I achieved this in this article.\n\n---\n\n## Short Introduction\n\nYou may not know what is Postman, so I'll describe it to you.\nYou may use any IDE (like PHPStorm, VSCode,β¦) to help you during the development phase of your project with things like autocompletion, test runs, debugging, and so on.\n\nPostman is quite the same as an IDE but designed especially to create APIs calls. It's a lot more pleasant to use than the plain old curl command. Learn more about Postman by visiting their website https://www.postman.com/.\n\nWhat about JSON Web Tokens (shortened to JWT in the rest of this article)? JWT is an open-source industry standard that defines a self-contained (i.e. information are held by the token) way for securely transmitting information between parties as a JSON object.\nIn our case, they'll be used to give us access to an API. Learn more about JSON Web Tokens by visiting their website https://jwt.io/.\n\n---\n\n## The journey to this magical world\n\n### In the begining, was the manual request\nAs a Web Developer, I'm used to call APIs (mine or third party APIs) that requires a JWT, and I usually test them using Postman.\nFor many months, or maybe years, calling an endpoint on those kinds of APIs led me to manually apply the following workflow:\n\n1. Get a token through a saved request attached to my Postman collection (basically authenticating toward my API)\n2. Copy the token string\n3. Create an "Authorization" header\n4. Paste the token string as a "Bearer" token as value for my "Authorization" header (header example: "Authorization:Bearer pastedTokenString")\n5. Finally, request my endpoint\n\nThis workflow also had me to update manually the JWT token when it has expired. By the time, I got a bit smarter by using Postman's environment variables in order to have the right token string stored in the proper environment (like having a JWT for the staging environment and one for the production).\n\nBut some months ago I was wondering if, as lazy as I am, there was a better way to make it? I also heard legends about some dev who calls his API calls without worrying about Authentication. So why not me?\n\n### Then was the automatic request\n\nSo like any good (or not π) developer, my journey has started onβ¦ (already guessed it π?) Stack Overflow!\n\nI found this article there, and even if it was not the right solution, it gave me a clearer idea of where to search. In fact, and to be honest, I was searching for a piece of code that I could quickly copy and paste eyes closed π
.\n\nSo I continued my quest, and I found Utkarsha Baksh's medium article "Using Postman Pre-request Script to Automatically Set Token" which has a perfect (and not too long) step by step tutorial. It details how to make a simple automatic login request before calling the desired API endpoint using small Postman's pre-request script. If you are new to that "pre-request script" concept, really shall read this article or take a look at Postman's documentation.\n\nAmazing plus, there's a piece of code! So I copy/pasted it, followed the steps, adapted it to my use cases, and it worked π π πͺ©!\n\nI never got back on it untilβ¦ I lost this pre-request script because of a Postman reinstallation and not having a paid version π«£ π©.\n\nThis leads us to this day (2022/12/12 π) where I was again doing the same manual routine and remembered that good old time when it was automatic.\n\n### Finally was the consecration\n\nSo another time, I packed my bag and got again on that journey to that wonderful land. The trip was a lot faster that time π
and I found a new piece of code that looked more detailed and more respectful of JWT's refresh mechanism by not always authenticating toward the API when the token is still valid (I mean not expired).\n\nThis code could be found there: https://gist.github.com/Glideh/0f24b8973bb7d79ae8124fa160966df1\n\nThe only cons I've found using it directly is that it was not taking advantage of the JWT's refresh token. So I copy/pasted it and made some changes to allow an automatic refresh of the token.\n\n---\n\n## The code\nTo get a full tutorial on how to define a the following code as a Postman's pre-request script read Utkarsha Baksh's medium article: "Using Postman Pre-request Script to Automatically Set Token"\n\n```javascript\n/**\n * fill in the blanks\n */\nconst TOKEN_ENV_VAR_NAME = 'token_client'\nconst LOGIN_URL = pm.environment.get("host") + "/api/v2/authenticate"\nconst LOGIN_BODY={\n "app_id": pm.environment.get("app_id"),\n "app_secret": pm.environment.get("app_secret")\n}\n\nconst REFRESH_TOKEN_ENV_VAR_NAME = 'refresh_token_client'\nconst REFRESH_URL = pm.environment.get("host") + "/api/v2/authenticate/refresh"\nconst REFRESH_BODY={\n "refreshToken": pm.environment.get(REFRESH_TOKEN_ENV_VAR_NAME)\n}\n\nfunction isExpiredToken() {\n const jwt = pm.environment.get(TOKEN_ENV_VAR_NAME)\n const payload = JSON.parse(atob(jwt.split('.')[1]));\n // Expiration timestamp (in seconds) is located in the `exp` key\n const millisecBeforeExpiration = (payload.exp * 1000) - (new Date()).getTime();\n if (millisecBeforeExpiration <= 0) {\n console.log("Token is expired");\n return true;\n }\n\n console.log(`Token is still valid ! Expiring in ${millisecBeforeExpiration / 1000} seconds`);\n return false;\n}\n\nfunction tokensExists() {\n const token = pm.environment.get(TOKEN_ENV_VAR_NAME)\n const refreshToken = pm.environment.get(REFRESH_TOKEN_ENV_VAR_NAME)\n if (!token) {\n console.log("Token not found");\n return false;\n }\n\n if (!refreshToken) {\n console.log("Refresh token not found");\n return false;\n }\n\n return true;\n}\n\nfunction login() {\n console.log("Authenticating")\n const body = JSON.stringify(LOGIN_BODY);\n const request = {\n url: LOGIN_URL,\n method: "POST",\n header: {\n "Content-Type": "application/json",\n "Accept": "application/json",\n },\n body,\n };\n\n pm.sendRequest(request, (err, res) => {\n if (err || res.code !== 200) {\n console.log("Login failed:");\n console.log(err);\n console.log(res);\n\n throw new Error('Login failed, check postman\\'s console for details')\n }\n pm.environment.set(TOKEN_ENV_VAR_NAME, res.json().token);\n console.log("Token saved");\n pm.environment.set(REFRESH_TOKEN_ENV_VAR_NAME, res.json().refreshToken);\n console.log("Refresh Token saved");\n });\n}\n\nfunction refresh() {\n console.log("Refreshing token")\n const body = JSON.stringify(REFRESH_BODY);\n const request = {\n url: REFRESH_URL,\n method: "POST",\n header: {\n "Content-Type": "application/json",\n "Accept": "application/json",\n },\n body,\n };\n\n pm.sendRequest(request, (err, res) => {\n if (res.code === 498) {\n console.log('Refresh token has expired or is invalid')\n login()\n return\n }\n if (err || res.code !== 200) {\n console.log("Refreshing token failed:");\n console.log(err);\n console.log(res);\n\n throw new Error('Refreshing token failed, check postman\\'s console for details')\n }\n console.log("Token refreshed");\n pm.environment.set(TOKEN_ENV_VAR_NAME, res.json().token);\n });\n}\n\nif (tokensExists()) {\n if (!isExpiredToken()) {\n return\n }\n\n refresh()\n} else {\n login()\n}\n```\n\n---\n\n## Thanks\n\nPostman for producing tools that ease API developer's life\n\nStack overflow and his community for being the developer's life-buoy\n\nPierre de LESPINAY for the Gist that inspired me this piece of code and the current article\n\nSensioLabs' Team for their help and their reviews on this article"
}
}
]
}