llaumegui27
commented
4 months ago Update, after searching for a long time, I've succeded to make it work, but in an unconventional way. I'll explain, when I was looking in files generated by compiling of my api spec (swagger.json), particularly in grammar.json and grammar.py.
For my grammar.json I was surprised not to see an Authorization field in headers part :
{
"Requests": [
{
"id": {
"endpoint": "",
"method": "Get"
},
"method": "Get",
"basePath": "",
"path": [],
"queryParameters": [
[
"Schema",
{
"ParameterList": []
}
]
],
"bodyParameters": [
[
"Schema",
{
"ParameterList": []
}
]
],
"headerParameters": [
[
"Schema",
{
"ParameterList": []
}
],
[
"DictionaryCustomPayload",
{
"ParameterList": []
}
]
],
"token": "Refreshable",
"headers": [
[
"Accept",
"application/json"
],
[
"Host",
"localhost:8080"
],
],
"httpVersion": "1.1",
"requestMetadata": {
"isLongRunningOperation": false
}
},
[...]Then I went to check de grammar.py and I had the idea to add my Authorization token here, like this :
# Endpoint: , method: Get
request = requests.Request([
primitives.restler_static_string("GET "),
primitives.restler_basepath(""),
primitives.restler_static_string("/"),
primitives.restler_static_string(" HTTP/1.1\r\n"),
primitives.restler_static_string("Accept: application/json\r\n"),
primitives.restler_static_string("Host: localhost:8080\r\n"),
primitives.restler_static_string("Authorization: Bearer <MY_JWT_TOKEN>\r\n"), # I've just add this line
primitives.restler_refreshable_authentication_token("authentication_token_tag"),
primitives.restler_static_string("\r\n"),
],
requestId=""
)
req_collection.add_request(request)And after launching the Test command : ../restler/Restler test --grammar_file Compile/grammar.py --dictionary_file Compile/dict.json --settings Compile/engine_settings.json --no_ssl :
Starting task Test...
Using python: 'python3' (Python 3.11.7)
Request coverage (successful / total): 1 / 6
Attempted requests: 5 / 6
No bugs were found.
See 'coverage_failures_to_investigate.txt' to investigate API coverage.
Task Test succeeded.
Collecting logs...It worked, here I only modified one route (the root of the "/" api) on my other routes, which is why you see 1/6. Now I'd like to know why the compilation of my swagger.json doesn't take into account the authorization part that should appear in grammar.json and grammar.py. (You can see a trailer of my specification file in my first post where I specify that certain API routes require a JWT bearer authorization token)
I'd also like to know how it's displayed in these two files when the specification is compiled correctly, so that we can use the location method or other with the engine_settings.json configuration, because my engine_settings.json contains only this:
{
"max_combinations": 20,
"exclude_requests": [
{
"endpoint": "/login",
"methods": ["POST"]
}
]
}Any help is welcome !
marcindulak
Description
Hi, I would like to fuzz my API with a Bearer token (JWT). I have many routes on my NodeJS API with a special route /login which return a token if your username and password sent in the request body are correct. Then I can use this token for access to all my API, for example a curl request which work fine :
curl -X GET -H "Accept: application/json" -H "Host: localhost:8080" -H "Authorization: Bearer <MY_JWT_TOKEN>" http://localhost:8080/So I've tried two methods seen in the Authentication.md and SettingsFile.md, the Module and the Location but neither of them worked. Firtsly, a trailer of my swagger.json file :
I've only put the interesting parts of this swagger.json and I've tested it on swagger editor and it's fine. After compiling the file, I try the Test and that's when the problems start.
For the Location method :
My engine_settings.json :
I'm excluding the /login route at first because I don't need to test it and I already have a valid token in my authentication_token.txt file which just contains a line with my token, like :
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6Imd1aWxsYXVtZSIsImlhdCI6MTcwNzQ4NTQ3MSwiZXhwIjoxNzA3NTA3MDcxfQ.n1rP__tMb1qIquDjrh057jGLUSBgfeX9XUwfbD9L8gEExcept the engine_settings.json file, I didn't change anything else. I don't know if I needed to change anything according to the documentation, if I've understood correctly.
Then i make my Test command :
../restler/Restler test --grammar_file Compile/grammar.py --dictionary_file Compile/dict.json --settings Compile/engine_settings.json --no_sslThe result :A trailer of my coverage_failures_to_investigate.txt for the root route :
It's sending me back a 400 Bad request error, so I don't know what the problem is. I think it's not managing to format the request header properly with a Bearer token, so if anyone can help me, I'd love to! Basically, I wanted to show both methods, but I thought it was a bit much.