4

We are implementing a new service which requires Authorisation by the way of a JWT.

I already have the submission and returned body containing the "access_token"

My question is how do I set up a call to decode the JWT (I have the following from a google search:)

function jwt_decode(JWT) { var parts = JWT.split('.'); // header, payload, signature return JSON.parse(atob(parts1)); }

Once I have it decoded I then need to test that the relevant information is contained within.

I think I will need an environment/user file to store some variables but I'm not sure what I would need to store.

I currently have a "POST" to generate the "access_token", but not sure what to do next. Do I need a "GET" to decode the JWT? What Authorisation do I need?

EDIT

So I've got my "access token" into an environment variable. What I want to do now is decode the Access token and split it out so that I can confirm (Create Tests) the individual results in the PayloadEncoded and decoded JWT.  I need to the the contents of the Payload section (circled in Red)

Any comments or suggestions would be appreciated. Can I do that within the same Post Call in postman, does it need a separate "POST" or "GET". I'm a QA with little Javascript (if that's what Postman uses for testing) experience so please be clear in any replies. Thanks

6
  • hi were you able to extract the token ? i believe know how you will use that token that token in request ?
    – PDHide
    Nov 26, 2019 at 13:58
  • Hi, Yes I was able to get the token.
    – Adam A
    Nov 26, 2019 at 14:19
  • 1
    dev.to/loopdelicious/… save it to a enviromental variable adn then call it from authorization header as {{<variablename>}}
    – PDHide
    Nov 26, 2019 at 14:21
  • Ok. I have my access_token stored to my environment variable. I have my Function to decode it (see above), which is on it's own "Get" tab, but as there it no url to call I don't see how I can get the access_token into the function to decode it.
    – Adam A
    Nov 26, 2019 at 15:09
  • 1
    i am not understanding what you actually want to do, if you want to reuse function, you can store function to an environmental variable adn run it using eval function
    – PDHide
    Nov 26, 2019 at 16:57

2 Answers 2

10

I am not sure what you want to do, if you are able to extract the access_token then i believe that you know to use the test script session in postman

Assuming you have the access_token stored in environmental variable swt:

you can use the below code in the same post request after you have stored the jwt to variable: (Keep this code in "Tests" tab and not pre-requisite scripts)

 function jwt_decode(a) {
    var parts = a.split('.'); // header, payload, signature
    return JSON.parse(atob(parts[1]));
}

pm.test("validate data", function () {
    //Get the token
    var a=pm.environment.get("swt");
    
    //call your function to decode it
    let decodedData=jwt_decode(a);
    
    

    //print the decodedData to console to see the structure
    console.log(decodedData);
    
     //print the required field and print it to console to see the value
    console.log(decodedData.iss);
 
    //validate it using pm expect
    pm.expect(decodedData.iss).to.deep.equal("toptal.com");
});

you can open console by going to view>show postman console. Clear everything and click send again:

enter image description here

if you want to use the swt variable in other requests you can do it as below:

enter image description here

  1. Goto "Authorization" tab
  2. Select the authorization type you want, usually its bearer token for jwt
  3. in the input field give {{swt}} (you can refer a variable anywhere in postman using the double curly bracket)

if you want to pass it as header , then go to header field and provide value as {{swt}} with correct 'Field' name

2
  • Thanks for you help. I've got it working now. :-)
    – Adam A
    Nov 28, 2019 at 13:08
  • 3
    Could you accept the answer , and upvote
    – PDHide
    Nov 28, 2019 at 13:13
0

Decode part

Suppose your response looks like: { "access_token": "eyJhbGciOiJSUzI1Ni.... Then just parse your "access_token" field in the Postman Tests tab:

var response = JSON.parse(responseBody);

var jwt_parts = response.access_token.split('.'); // header.payload.signature
var jwt_payload = JSON.parse(atob(jwt_parts[1]));

Save part

Now you can either test or save data to..., let's say, an env. variable "sub".

postman.setEnvironmentVariable("sub", jwt_payload.sub);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.