How to Format Header Input in JSON

Oct 13, 2025 by wbrum.org 78 views

Introduction

API authentication can be a complex process, especially when dealing with undocumented APIs. In this article, we will explore a common issue faced by developers when trying to set a token in the Cookie header for API authentication. We will also provide a step-by-step guide on how to properly format the header input in JSON.

Working Curl Commands

Before we dive into the issue, let's take a look at the working curl commands provided:

Login Request

curl -L "http://192.168.1.243/api/users/login" \
     -H "Connection: keep-alive" \
     --data-raw '{"username":"admin","password":"PASSWORD"}'

Response

{
    "data": {
        "alias": "Admin",
        "changed": true,
        "create_time": "1970-01-01 00:00:00",
        "descript": "",
        "id": 1,
        "phone": "",
        "role": "admin",
        "token": "80628e1697d4eb87910d2e4c2798d7a7",
        "username": "admin"
    },
    "result": "ok"
}

Command Execution

curl "http://192.168.1.243/api/layout/select" \
     -H "Cookie: language=en; time=undefined; tokenNew=undefined; username=admin; user=admin; alias=Admin; token=80628e1697d4eb87910d2e4c2798d7a7" \
     --data-raw '{"output_id":"1","layout_id":5}'

Response

{"result": "ok"}

My Current Approach

I'm trying to replicate this behavior programmatically with the following steps:

1. HTTP POST (Login)

Endpoint: http://192.168.1.243/api/users/login
Body: "username""admin","password":"PASSWORD"
Store the response in a custom variable (e.g., decoder_01_result)

2. Extract Token

Use a custom variable to extract the token from the login response:
- Expression: jsonpath($(custom:decoder_01_result), "$.data.token")
- Stored in: decoder_01_token

3. HTTP POST (Command Execution)

Endpoint: http://192.168.1.243/api/layout/select
Headers:
- "Cookie": "language=en; time=undefined; tokenNew=undefined; username=admin; user=admin; alias=Admin; token=$(custom:decoder_01_token)"
Body: {"output_id": "1", "layout_id": 3}

Issue

My approach fails to set the token correctly in the Cookie header using the variable $(custom:decoder_01_token). The request behaves as if the token is not being passed properly.

How to Format Header Input in JSON

To properly format the header input in JSON, you can use the following format:

{
    "Cookie": "language=en; time=undefined; tokenNew=undefined; username=admin; user=admin; alias=Admin; token=80628e1697d4eb87910d2e4c2798d7a7"
}

However, in your case, you want to use a variable to set the token. You can use the following format:

{
    "Cookie": "language=en; time=undefined; tokenNew=undefined; username=admin; user=admin; alias=Admin; token=${decoder_01_token}"
}

Note the use of ${decoder_01_token} instead of $(custom:decoder_01_token). This is because the ${} syntax is used to reference variables in JSON, while the $( ) syntax is used to reference variables in shell scripts.

Conclusion

In conclusion, the issue with setting the token in the Cookie header is due to the incorrect syntax used to reference the variable. By using the correct syntax and formatting the header input in JSON, you should be able to successfully set the token and authenticate with the API.

Additional Tips

Make sure to check the API documentation for any specific requirements or restrictions on setting cookies.
Use a tool like Postman or cURL to test your API requests and verify that the token is being set correctly.
If you're still having issues, try debugging your code or seeking help from a developer or API expert.
Unable to Set Token in Cookie Header for API Authentication ===========================================================

Q&A

Q: What is the issue with setting the token in the Cookie header? A: The issue is due to the incorrect syntax used to reference the variable. The $(custom:decoder_01_token) syntax is used in shell scripts, but in JSON, you should use ${decoder_01_token} to reference variables.

Q: How do I properly format the header input in JSON? A: You can use the following format:

{
    "Cookie": "language=en; time=undefined; tokenNew=undefined; username=admin; user=admin; alias=Admin; token=80628e1697d4eb87910d2e4c2798d7a7"
}

However, if you want to use a variable to set the token, you can use:

{
    "Cookie": "language=en; time=undefined; tokenNew=undefined; username=admin; user=admin; alias=Admin; token=${decoder_01_token}"
}

Q: What is the difference between ${} and $( ) syntax? A: The ${} syntax is used to reference variables in JSON, while the $( ) syntax is used to reference variables in shell scripts.

Q: How do I test my API requests and verify that the token is being set correctly? A: You can use a tool like Postman or cURL to test your API requests. Make sure to check the API documentation for any specific requirements or restrictions on setting cookies.

Q: What should I do if I'm still having issues with setting the token in the Cookie header? A: Try debugging your code or seeking help from a developer or API expert. Make sure to provide as much information as possible about the issue, including any error messages or logs.

Q: Are there any specific requirements or restrictions on setting cookies in the API? A: Yes, make sure to check the API documentation for any specific requirements or restrictions on setting cookies. Some APIs may have specific requirements for cookie names, values, or formats.

Q: Can I use a different method to authenticate with the API instead of setting a token in the Cookie header? A: Yes, you can use a different method to authenticate with the API, such as using a bearer token in the Authorization header or using a different authentication mechanism. Make sure to check the API documentation for any specific requirements or restrictions on authentication methods.

Q: How do I handle cases where the token is not being set correctly or is expired? A: You can use try-catch blocks or error handling mechanisms to handle cases where the token is not being set correctly or is expired. Make sure to provide a clear error message or response to the user, and consider implementing a retry mechanism or fallback authentication method.

Q: Are there any security considerations when setting a token in the Cookie header? A: Yes, make sure to follow best practices for secure cookie handling, such as using HTTPS, setting secure and httponly flags, and using a secure token format. Additionally, consider implementing additional security measures, such as token blacklisting or revocation.