1

I have an API on AWS API Gateway that takes a POST request and forwards headers and body to a third party API and returns the result. This process works fine when I send the request from Postman, but doesn't work either via cURL or JavaScript.

NB - all URIs, auth tokens etc below are modified so may be inconsistent between screengrabs.

The request in Postman is below

enter image description here

enter image description here

Postman console for this looks like

POST https://dsvdvsdvsdrc.execute-api.eu-west-1.amazonaws.com/Prod/
200
957 ms
Network
Request Headers
Authorization: Basic <myauthtoken>NTAwYTQxNDdmYzcyLWFkZDgtNDZmMy05ZWU0LWQzYWM=
Content-Type: application/x-www-form-urlencoded
User-Agent: PostmanRuntime/7.26.8
Accept: */*
Cache-Control: no-cache
Postman-Token: 9dab6f01-67bf-4611-8d8e-c3d5fe725067
Host: tsfsfsdrc.execute-api.eu-west-1.amazonaws.com
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 82
Request Body
grant_type: "client_credentials"
scope: "https://api.ebay.com/oauth/api_scope"

In my JavaScript app I have the following code:

var data = qs.stringify({
  'grant_type': 'client_credentials',
 'scope': 'https://api.ebay.com/oauth/api_scope' 
 });
 var config = {
   method: 'post',
   url: 'https://fddgdgddrc.execute-api.eu-west-1.amazonaws.com/Prod/',
   headers: { 
     'Authorization': 'Basic sssscyLWFkZDgtNDZmMy05ZWU0LWQzYWM=', 
     'Content-Type': 'application/x-www-form-urlencoded'
   },
   data : data
 };
 console.log("******Here is ebayData REQUEST***** "+ JSON.stringify(config));
 axios(config)
 .then(function (response) {
   console.log("******Here is ebayData***** "+ JSON.stringify(response.data));
 })
 .catch(function (error) {
   console.log( "******Here is ebay Error***** "+ error);
 });

However when the application runs I get a 500 response. Below are the request headers and body that is being sent in the request

enter image description here enter image description here

I've enabled cloudwatch logs on the API and below is an example of a successful request via Postman

enter image description here

and here is an example of an unsuccessful request from the browser

enter image description here

Looking further into the response headers for a failed and a successful response I see the headers with comments against them are different

Failed request

(d360923b-eff2-433f-8f76-a9038547dcdf) Endpoint response headers: {rlogid=t6ldssk67%3D9whhldssk67*qc1qr%28rbpv6710-17dd35648ce-0x129, 
x-ebay-c-version=1.0.0, 
x-frame-options=SAMEORIGIN, 
x-content-type-options=nosniff, 
x-xss-protection=1; mode=block, 
set-cookie=ebay=%5Esbf%3D%23%5E;Domain=.ebay.com;Path=/; Secure,dp1=bu1p/QEBfX0BAX19AQA**6581b87b^;Domain=.ebay.com;Expires=Tue, 19-Dec-2023 15:36:27 GMT;Path=/; Secure, 
content-encoding=gzip, 
cache-control=private, <--- doesn't appear in successful response
pragma=no-cache,   <--- doesn't appear in successful response
date=Sun, 19 Dec 2021 15:36:26 GMT, 
server=ebay-proxy-server, 
x-envoy-upstream-service-time=19, 
x-ebay-pop-id=UFES2-RNOAZ03-api, 
transfer-encoding=chunked}

Successful request

(fe565553-3283-4593-8b07-b4e2d58dd2a6) Endpoint response headers: {rlogid=t6ldssk67%3D9vjdldssk67*5cddm%28rbpv6775-17dd23fa53c-0x124, 
x-ebay-c-version=1.0.0, 
x-ebay-client-tls-version=TLSv1.2,<--- doesn't appear in failed response
x-frame-options=SAMEORIGIN, 
x-content-type-options=nosniff, 
x-xss-protection=1; mode=block, 
set-cookie=ebay=%5Esbf%3D%23%5E;Domain=.ebay.com;Path=/; Secure,dp1=bu1p/QEBfX0BAX19AQA**65817126^;Domain=.ebay.com;Expires=Tue, 19-Dec-2023 10:32:06 GMT;Path=/; Secure, 
content-encoding=gzip, 
content-type=application/json,<--- doesn't appear in failed response 
date=Sun, 19 Dec 2021 10:32:06 GMT, 
server=ebay-proxy-server, 
x-envoy-upstream-service-time=96, 
x-ebay-pop-id=UFES2-SLCAZ01-api, 
transfer-encoding=chunked}

I think I've been looking at this for too long and am probably missing something obvious, but headers and body etc all seem to be consistent across the app and Postman, so I'm confused why the request from one is successful and the other is failing. Any advice much appreciated.

Stuart Brown
  • 977
  • 2
  • 22
  • 47
  • Did you look at the actual raw request and compared it? Using something like Fiddler I mean, not things that show a brushed-up representation of it. – CherryDT Dec 19 '21 at 12:00
  • You can use postman only to generate required js code. Try that out – Ryker Dec 19 '21 at 12:01
  • Also you are showing the logs for an OPTIONS request (preflight probably) and not POST in the first case. – CherryDT Dec 19 '21 at 12:03
  • @CherryDT I hadn't heard of Fiddler before, thanks I'll take a look. Re the preflight logs, good catch. I've updated the question with the actually request now – Stuart Brown Dec 19 '21 at 12:14
  • @Ryker the code I've shown is the code generated by Postman. Originally I had my own code to call this but in desperation switched to the code generated by Postman – Stuart Brown Dec 19 '21 at 12:15
  • In Fiddler you'll need to enable HTTPS decryption and install the root certificate or bypass the certificate error in the client, so it can look inside the HTTPS packet and show the raw HTTP request. In case of CURL you'd probably also have to pass `http://localhost:8888` as proxy then. – CherryDT Dec 19 '21 at 12:17

1 Answers1

0

Add all other headers as in Postman , some application rejects requests without proper user-agent header or some other required headers.

PDHide
  • 18,113
  • 2
  • 31
  • 46