传递 REST API 身份验证令牌在 PostMan 中工作但不是 Python 请求

Question

I'm trying to use Python Requests to access some information via a REST API. The API that I am using requires authentication, and after a login request the response will contain a session ID that is then supposed to be included in the header of all future requests. The API documentation states:

Once the authentication is successful, a JSON response with an access token is returned. The token needs to be set in the headers of all subsequent requests for them to be processed successfully. The API client should add an HTTP header with name "blabla_session_id", the same cookie name as in the Web Application

I am able to successfully send a login request and receive a response with the session ID, however I am having trouble using Python Requests to add the session ID to the header. I am using the following code:

# Functions

def login(base_url, username, password):
    print("Getting token...")
    header = {'content-type':'application/json'}

    data_get = {'email': username,
                'password':password,
                'workspaceId':12345678} 

    r = requests.post(base_url+'login', headers=header, json=data_get)

    if r.ok:
        print("Login Success!")
        global session_id   
        session_id = r.cookies['blabla_session_id']
        print("Session ID is %s" %session_id)

    else:
        print("Login Fail...")
        print("HTTP %i - %s, Message %s" % (r.status_code, r.reason, r.text))

def logout():
    header = {'blabla_session_id':session_id,'content-type':'application/json'}
    print (header)

    r = requests.put(base_url+'logout', headers=header)
    print (r.request.headers)

    if r.ok:
        print("Logout Success")
    else:
        print("Logout Failed")
        print("HTTP %i - %s, Message %s" % (r.status_code, r.reason, r.text))

def main():
    login(base_url, api_login, api_password)
    logout()

# Main Program
main()

When I execute this, I get the following response:

Getting token...
Login Success!
Session ID is LABS-FReGnWuzzj7oYQ4nzPdvB55rOpctU48s%7C
{'blabla_session_id': 'LABS-FReGnWuzzj7oYQ4nzPdvB55rOpctU48s%7C', 'content-type': 'application/json'}
{'User-Agent': 'python-requests/2.25.1', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive', 'blabla_session_id': 'LABS-FReGnWuzzj7oYQ4nzPdvB55rOpctU48s%7C', 'content-type': 'application/json', 'Content-Length': '0'}
Logout Failed
HTTP 401 - , Message {"status":401,"errors":[{"code":401,"message":"There is no access token associated with this request or the access token is not valid."}]}

Command Line Response

Any ideas where I'm going wrong? As the title suggests, I did try using PostMan to verify the API and I am able to login, add the session ID to the header and logout without issue. I suspect this has something to do with the format of the header, but I'm not sure.

Answer 1

Move to using a single requests session and that will propagate particularly cookies across all your http actions ensuring that successful authentication is carried over into all requests.

For example:

import requests

def login(s,base_url, username, password):
    print("Getting token...")
    header = {'content-type':'application/json'}

    data_get = {'email': username,
                'password':password,
                'workspaceId':12345678} 

    r = s.post(base_url+'login', headers=header, json=data_get)

    if r.ok:
        print("Login Success!")
        global session_id   
        session_id = r.cookies['blabla_session_id']
        print("Session ID is %s" %session_id)

    else:
        print("Login Fail...")
        print("HTTP %i - %s, Message %s" % (r.status_code, r.reason, r.text))

def logout(s):
    header = {'blabla_session_id':session_id,'content-type':'application/json'}
    print (header)

    r = s.put(base_url+'logout', headers=header)
    print (r.request.headers)

    if r.ok:
        print("Logout Success")
    else:
        print("Logout Failed")
        print("HTTP %i - %s, Message %s" % (r.status_code, r.reason, r.text))

def main():
    s = requests.session()
    login(s,base_url, api_login, api_password)
    logout(s)

# Main Program
main()

Answer 2

On your logout header there is no content-type. Might be the issue here!