Search code examples
javagetpostmanhttprequestaccess-token

Bearer token working in Postman but not in Server

The api changed some of it´s security configurations tonight, but i have been doing server side calls for a few months so i discard this being a problem in the server.

This is my configuration in postman

API Call works fine

Hello, this is my API Call in JAVA

{Authorization=Bearer XXXXXXXXXXXXXXXX, headers={Content-Type=application/json}, params={limit=50, state=published, page=1}, url=https://app.tuotempo.com/api/v3/tt_portal_fiatc_test/catalog}

The exception i get in the HTTPRequest from JAVA is

{"result":"ERROR","return":[],"msg":"ACCESS RIGHT DENIED","exception":"TUOTEMPO_SERVICE_NOT_ALLOWED","execution_time":"","debug":"You need a valid access right for the instance tt_portal_fiatc_test"}

What i am missing?

EDIT: Additional INFO: the GET call in JAVA

Generic GET Method in my Code

EDIT2: Already tried without the "bearer" just with Auth: XXXXX.

{Authorization=XXXXXXXXXXXXXXXX, headers={Content-Type=application/json}, params={limit=50, state=published, page=1}, url=https://app.tuotempo.com/api/v3/tt_portal_fiatc_test/catalog}
RESPUESTA{headers={content-type=application/json, transfer-encoding=chunked, vary=Accept-Encoding, expires=Thu, 19 Nov 1981 08:52:00 GMT, cache-control=no-cache, pragma=no-cache, set-cookie=lang=es; expires=Sun, 25-Dec-2022 05:31:28 GMT; Max-Age=2592000; path=/; secure; HttpOnly, x-status-code=403, date=Fri, 25 Nov 2022 05:31:28 GMT, connection=close}, status_code=403, reason_phrase=Forbidden, content=[B@241dde53}
CONTENT: {"result":"ERROR","return":[],"msg":"ACCESS RIGHT DENIED","exception":"TUOTEMPO_SERVICE_NOT_ALLOWED","execution_time":"","debug":"You need a valid access right for the instance tt_portal_fiatc_test"}
Solution

  • It was a silly thing in the end. As we can see in the logs (visible in EDIT2 for example).

    The Auth. is OUTSIDE the HEADERS, if it´s not in the headers, the API doesn´t read it.

    There was a security problem in the API and this was the way to discover that the API (third party one) was PUBLIC since it´s implementation, that´s why we didn´t thought that the call wasn´t well implemented.