8

I'm trying to use Postman to send a GET http request which contains a parameter which is dynamically generated by taking the full request query string (everything to the right of the question mark in the URL, after URL encoding), concatenating a previously assigned shared secret key, and then performing a SHA-1 hash of the resulting string.

I would use a Pre-request Script to achieve this.

Thank you.

2 Answers 2

10

I actually found a solution and would like to share it.

var params = [
    ["client_id", "222"]
    ,["account_id", ""]
];

// Build the request body string from the Postman request.data object
var requestBody = "";
var firstpass = true;
for(var i=0;i < params.length; i++) {
        if(!firstpass){
            requestBody += "&";
        }
        requestBody += params[i][0] + "=" + params[i][1];
        firstpass = false;
        postman.setGlobalVariable(params[i][0], params[i][1]);
}
requestBody += postman.getEnvironmentVariable("sharedSecretKey");
postman.setGlobalVariable("requestBody", requestBody);

var mac = "";
if(requestBody){
    // SHA1 hash
    mac = CryptoJS.SHA1(requestBody);
}

postman.setGlobalVariable("mac", mac);

Then I just need to set the parameters in the URL : {{baseUrl}}/get?client_id={{client_id}}&account_id={{account_id}}&mac={{mac}}

where {{baseUrl}} is an environment variable and {{client_id}}, {{account_id}} are global variables

Hope it can be helpful to someone.

Thank you.

1
  • Just what I was looking for. Thanks! :)
    – Loaf
    Mar 7, 2018 at 19:46
8

Inspired by this answer, I used the following Postman pre-request script to create a SHA1 hash of a request.

Note that request.data is an implied variable and the CryptoJS library are provided by the Postman Sandbox for pre-request scripts.

const hash = CryptoJS.HmacSHA1(request.data, 'yourSecret').toString();
pm.globals.set('hash', hash);

You can now reference the hash value as a postman global variable using {{hash}} syntax.


Creating X-Hub-Signature Header like GitHub API Webhook Requests

My purpose in all this was to simulate the X-Hub-Signature header provided by the GitHub Webhooks API because my web service validates all webhook payloads to match the signature. So for me to test my web service, I also needed postman to generate a valid signature header.

Here's an adaptation of the above code snippet for generating the X-Hub-Signature request header value.

  1. In GitHub, I set a webhook secret for my GitHub App.

github webhook secret

  1. In Postman, I created an environment and added the key=value pair GITHUB_WEBHOOK_SECRET with the value I specified when I created my GitHub App.

postman environment variable

  1. In Postman, I used the following pre-request script. It set the computed hash as a global variable.
const hash = CryptoJS.HmacSHA1(
    request.data,
    pm.environment.get('GITHUB_WEBHOOK_SECRET')
).toString();
pm.globals.set('X-HUB-SIGNATURE', 'sha1=' + hash);
  1. In Postman, I reference the global hash variable as a header in my requests, just like the GitHub Webhooks API will.

postman request header

1
  • 1
    It is worth saying to anyone else picking this up that if you end up with the word "object" being passed to your API then you need to add .toString() to the end of the const line
    – Antony
    Jul 22, 2021 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.