JHipster authentication using Postman and JWT

Question

I'd been using the Postman in-tab extension to tests calls to call JHipster resource API's and found that it worked great (JHipster setup to use OAuth2). I authenticated using the JHipster login page, then opened up a new tab with the Postman extension.

I just switched my JHipster application to use JWT and this method of using Postman no longer works, I get permission denied when calling the API. Moreover, the in-tab extension for Postman is being deprecated in favor of the stand-alone app.

Question: Is there any documentation on setting up Postman for authenticating against JHipster/JWT?

score 27 · Accepted Answer · answered Apr 24 '17 at 17:22

27

Make a POST request to /api/authenticate with the following body: {"password":"admin","username":"admin"}. You will receive the following response: {"id_token":"aabbccddeeff"}
Make your subsequent requests using the value of the token received in the previous call and put in into an Authorization: Bearer aabbccddeeff
You can check the status of the authentication, making a GET request to /api/authenticate endpoint

answered Apr 24 '17 at 17:22

Alessandro Dionisi

2,494
4
33
37

1

unfortunately, I get an error 403 when I try to use the default admin credentials – dfsg76 Jul 23 '17 at 22:33
2

For me it says, { "type": "http://www.jhipster.tech/problem/problem-with-message", "title": "Unauthorized", "status": 401, "detail": "Full authentication is required to access this resource", "path": "/api/authenticate", "message": "error.http.401" } – Imran Mar 18 '18 at 10:17
For me returns success (200) but without token. – Adrian Aug 26 '20 at 12:52
I put example curl calls for this check http://blog.mascix.com/2021/10/jhipster-login-and-how-to-call-rest-api.html – ozkanpakdil Oct 18 '21 at 17:09

score 17 · Answer 2 · answered Dec 12 '16 at 19:57

17

It is possible to use Postman with a JWT JHipster app.

First, authenticate with the JHipster app
Inspect any API request for the Authorization header. The JWT token is the value to the right of "Bearer ". You can also find this token in the browser's localStorage under the key jhi-authenticationToken.

Edit the headers in Postman and add the Authorization header. The value should look like the following:

Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJydRkZWxsIiwiYXV0aCI6IlJPTEVfQURNSU4sUk9MRV9U0VSIiwiZXhwIjoxNDgzOTg1MDkzfQ.1A13sBvr3KDWxJQpKDKOS33KAVjWIb3mS_qfxLBOCq_LbMwNHnysAai0SNXXgudMOulAnXYN9_Mzlcv1_zctA

answered Dec 12 '16 at 19:57

Jon Ruddell

6,244
1
22
40

1

This works but it's a pain in the you-know-what. Having to copy paste in the authorization for each request after a new login slows one down and one loses the ability to iterate quickly. – geoidesic Jan 28 '18 at 12:02
@geoidesic use a environment variable. Then you can have all of your apis like Bearer {{token}}. – Will May 11 '18 at 18:39

score 12 · Answer 3 · answered Mar 27 '19 at 09:28

If you have deployed a single microservice and you want to test it in isolation you can configure Postman to build a JWT token using a pre-request script.

Go to the application-dev.yml file generated by JHipster and grab the base64-secret value:

security:
    authentication:
        jwt:
            # This token must be encoded using Base64 and be at least 256 bits long (you can type `openssl rand -base64 64` on your command line to generate a 512 bits one)
            base64-secret: N2Y2MmFkNzg2ZTI4NTZiZGEwMTZhYTAzOTBhMjgwMzlkMzU2MzRlZjJjZDA2MzQ0NGMxOGFlZThjOWY0MjkzNGVlOGE3ZjkxZGI5ZTQxOGY3MjEwNWUwYTUxMTUxODYxY2U4ZWMzZjVhMjg0NTZkNzlhNWUyMmEyNjQ5NzkxZmI=

Put the value in a variable named jhipster_jwt_secret inside the Postman Environment.
Configure your pre-request script (this is largely copied from a Gist):

function base64url(source) {
    // Encode in classical base64
    encodedSource = CryptoJS.enc.Base64.stringify(source);

    // Remove padding equal characters
    encodedSource = encodedSource.replace(/=+$/, '');

    // Replace characters according to base64url specifications
    encodedSource = encodedSource.replace(/\+/g, '-');
    encodedSource = encodedSource.replace(/\//g, '_');

    return encodedSource;
}

var header = {
    "typ": "JWT",
    "alg": "HS256"
};

var payload = {
  "sub": "user",
  "auth": "role"
};

var secret = CryptoJS.enc.Base64.parse(postman.getEnvironmentVariable("jhipster_jwt_secret"));

// encode header
var stringifiedHeader = CryptoJS.enc.Utf8.parse(JSON.stringify(header));
var encodedHeader = base64url(stringifiedHeader);

// encode data
var stringifiedPayload = CryptoJS.enc.Utf8.parse(JSON.stringify(payload));
var encodedPayload = base64url(stringifiedPayload);

// build token
var token = encodedHeader + "." + encodedPayload;

// sign token
var signature = CryptoJS.HmacSHA256(token, secret);
signature = base64url(signature);
var signedToken = token + "." + signature;

postman.setEnvironmentVariable("jwt_token", signedToken);

Inside the Authorization tab select "Bearer token" and write {{jwt_token}} in the Token input field.

Just what I was looking for, since I have a microservice with JWT authentication. and it works perfectly. Many thanks. — dchang, Sep 10 '19 at 13:31
This is a good advice. Thank you. But here I have to take the secret from jhipster-registry configuration. How are you developing a microservice without a jhipster-registry instance? — EduMelo, Mar 18 '20 at 13:17

score 2 · Answer 4 · answered Oct 19 '18 at 15:45

The easiest way for me is

log into your Jhipster Web app with the admin credential
Select Administration > API

Then choose any of existing API and click 'Try it out' button

It will list a curl action with the token, now you can grab the token and use it in Postman

JHipster authentication using Postman and JWT

4 Answers4

Linked