Unusual comma in Authorization header

mostlyjason · August 9, 2019, 11:28pm

Hi I’m getting a weird comma inserted automatically in the authorization header for bearer tokens. This causes the API to fail authorization and return an error. Its preventing it from using Postman at all.

I added the Bearer token in the UI. It also displays correctly in the temporary headers section when I click Send. However, I get back an error message from the API. When I check for the curl code I see this weird comma right before the word “Bearer.”

curl -X GET \
  http://localhost:8080/api/invite-code/autocomplete \
  -H 'Accept: */*' \
  -H 'Accept-Encoding: gzip, deflate' \
  -H 'Authorization: ,Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImFjY2Y2YjVjLTY4YzUtNGU3Mi1hY2U3LTljMDc3MGEwYjI4MCIsIplhdCI6MTU2NTM5NzA4OX0.95K8oZUkPJQaTjjorGViE_-uAZyx1k5eNCsyXvQh5jI' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Host: localhost:8080' \
  -H 'Postman-Token: ca420ed0-980c-4c7c-a9fa-eb17858a52b8,b555dbc4-8f6f-4a93-a4db-c0294769ca73' \
  -H 'User-Agent: PostmanRuntime/7.15.2' \
  -H 'cache-control: no-cache'
Forbidden

When I remove the comma it works fine:

curl -X GET \
  http://localhost:8080/api/invite-code/autocomplete \
  -H 'Accept: */*' \
  -H 'Accept-Encoding: gzip, deflate' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImFjY2Y2YjVjLTY4YzUtNGU3Mi1hY2U3LTljMDc3MGEwYjI4MCIsIplhdCI6MTU2NTM5NzA4OX0.95K8oZUkPJQaTjjorGViE_-uAZyx1k5eNCsyXvQh5jI' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Host: localhost:8080' \
  -H 'Postman-Token: ca420ed0-980c-4c7c-a9fa-eb17858a52b8,b555dbc4-8f6f-4a93-a4db-c0294769ca73' \
  -H 'User-Agent: PostmanRuntime/7.15.2' \
  -H 'cache-control: no-cache'
{"rows":[{"id":"bc74eb7f-b2d8-4ab7-b85f-8a87226502ee","....

Where does this comma come from and how can I remove it? I’m using Postman 64-bit v7.3.6 on Ubuntu 18.04.

vdespa · August 12, 2019, 2:27pm

Try removing the header Authorization and using the Bearer authorization helper. Does that work?

If not, could you attach some more screenshots (including some from the Postman console?).

mostlyjason · August 12, 2019, 6:44pm

Ok thanks I didn’t know about the Postman console before. I checked and the problem was that my baseURL variable was adding double slashes resulting in a 404. This is an automatic import from swagger so something in that pipeline isn’t set up correctly.

Checking the console I also saw that the comma is not present in the request from the Postman UI. So it’s just the code generator that’s adding the incorrect comma now. That’s not essential for me since I can manually edit it, but its still something the postman team might want to look into. I am using the Bearer token helper as you can see below. It gets passed down through 2 folders with inherit from parent, with this token defined on the collection.