How to set the request body via Postman’s pre-request script

postmanpostman-pre-request-script

I use Postman 6.0 to send an HTTP request. To send a request, I use a pre-request script to get a token and put it into the environment so that it will be used in the succeeding requests.

The script below doesn't work because the body is not sent. Is there anything wrong with the script below?

const getTaxAccessToken={
  url: 'http://dev.xxx.com:4001/api/v1/portal/account/tax-login',
  method: "post",
  body: {
      'loginIdentity': 'admic',
      'password': 'abc123'
  },
  header: {
      'Content-Type': 'application/json'
  }
};
pm.sendRequest(getTaxAccessToken, function (err, response) {
  console.log("get accesstoken");
  console.log(response.access_Token);
  pm.environment.set("taxAccessToken", response.access_Token);
});

Best Answer

Try this.

  body: {
     mode: 'raw',
     raw: JSON.stringify({'loginIdentity': 'admic', 'password': 'abc123'})
  }

Related Solutions

Javascript – How to run one request from another using Pre-request Script in Postman

As mentioned by KBusc and inspired from those examples you can achieve your goal by setting a pre-request script like the following:

pm.sendRequest({
    url: pm.environment.get("token_url"),
    method: 'GET',
    header: {
        'Authorization': 'Basic xxxxxxxxxx==',
    }
}, function (err, res) {
    pm.environment.set("access_token", res.json().token);
});

Then you just reference {{access_token}} as any other environment variable.

Php – When used correctly, is htmlspecialchars sufficient for protection against all XSS

htmlspecialchars() is enough to prevent document-creation-time HTML injection with the limitations you state (ie no injection into tag content/unquoted attribute).

However there are other kinds of injection that can lead to XSS and:

There are no <script> tags in the document.

this condition doesn't cover all cases of JS injection. You might for example have an event handler attribute (requires JS-escaping inside HTML-escaping):

<div onmouseover="alert('<?php echo htmlspecialchars($xss) ?>')"> // bad!

or, even worse, a javascript: link (requires JS-escaping inside URL-escaping inside HTML-escaping):

<a href="javascript:alert('<?php echo htmlspecialchars($xss) ?>')"> // bad!

It is usually best to avoid these constructs anyway, but especially when templating. Writing <?php echo htmlspecialchars(urlencode(json_encode($something))) ?> is quite tedious.

And... injection issues can happen on the client-side as well (DOM XSS); htmlspecialchars() won't protect you against a piece of JavaScript writing to innerHTML (commonly .html() in poor jQuery scripts) without explicit escaping.

And... XSS has a wider range of causes than just injections. Other common causes are:

allowing the user to create links, without checking for known-good URL schemes (javascript: is the most well-known harmful scheme but there are more)
deliberately allowing the user to create markup, either directly or through light-markup schemes (like bbcode which is invariably exploitable)
allowing the user to upload files (which can through various means be reinterpreted as HTML or XML)

Best Answer

Related Solutions

Javascript – How to run one request from another using Pre-request Script in Postman

Php – When used correctly, is htmlspecialchars sufficient for protection against all XSS

Related Topic