In order to debug APIs with 3rd Parties, it is often helpful to see the API requests and responses.
For Shopware 5 there was an extension for this purpose.
How to log API requests and responses in Shopware 6 ?
It depends which API scope you want to log requests for. There's store-api, api (commonly referred to as Admin-API) and storefront (not really an API in a narrower sense). If you want to log requests to just one of the scopes or log them to different file name patterns, then you could take a look at the RouteScopeListener on how to retrieve the scope from the request stack.
You could then rebuild this listener in a plugin of yours and additionally inject the logger service. In the handler you then might check that the scope is one of those you want to log data for. Depending on that select the data from the request stack you want to log and where to log it.
Related
Salutations!
I have just completed my first REST API, deployed on heroku, and I decided it would be cool to make $0 a month through rapidAPI.
The rapidAPI testing dashboard passes the tests successfully - with one of their keys being a requirement for an API call.
However when I access the site on a browser or on Postman, there is no need for an API key and therefore no restrictions in get requests.
I have noticed that the test code makes a fetch request to the rapidAPI url for the project but how can I make the heroku url accessible only from rapidAPI?
I know it's extremely unlikely someone will find my heroku app url but it is technically possible.
I appreciate your time and insights.
RapidAPI provides 2 security features to support this:
set X-RapidAPI-Proxy-Secretin the API Dashboard: this token is added in the X-RapidAPI-Proxy-Secret HTTP header for each request. You should validate this for every API call. This is the default measure in place.
the list of IP addresses used by RapidAPI is provided: you can check/validate for every API call.
There might be Heroku Addon to help with the IP filtering, but those are typically enterprise-plugin (with associated cost).
RapidAPI allows you to add secret headers and/or query string parameters to API requests. The RapidAPI proxy adds these secrets to every request, but are hidden from the API consumers.
Find more details in this page: https://docs.rapidapi.com/docs/secret-headers-parameters
Single page application with specific organizational service accounts uses microsoft authorization (2.0).
To pretend in JMeter as user working with this application, it is enough to have Bearer access_token and then pass this Bearer in header of JMeter script requests.
I can manually login with user credentials in browser, get Bearer and set up it as variable in JMeter in API requests headers and successfully continue to work with application functionality.
Also I can login in WebDriverSampler (and I suppose, can emulate with WebDriverSampler another user's actions with application like in "browser").
What is the simplest and shortest way, having all above, to get Bearer somehow for API calls in a script without time-consuming or programming-oriented complex solutions? Is it possible somehow to use WebDriverSampler requests for parsing Bearer?
On this stage, the goal is to collect (and generate) Bearers, which have long time of life, with intention to use this set of Bearers for multi-session JMeter "users" later. (Because users amount is under cost constrtaints with users service accounts, i.e. I have 1 provided user only).
Will be very appreciated for grace tips and advices with such kind of problem.
It should be possible to use i.e. BrowserMob Proxy for capturing the traffic between the browser orchestrated by the WebDriver Sampler and the backend, this way you will be able to extract Authorization header value and i.e. store it into a CSV file for later re-use.
In general it should also be possible to replicate the browser's authentication flow with JMeter's HTTP Request samplers as browsers don't do any magic, they just send HTTP Requests and display the responses so well-behaved JMeter test should generate the same network footprint as the real browser does
I have recorded a login flow of an application and found some URIs like below:
/api/oauth2/initiate GET
/oauth2/authorize GET
/api/v1/oauth2/authorize GET
/api/v1/oauth2/authenticate POST
{"username":"${Username}","password":"${Password}","client_id":"${client_Id}","response_type":"code","redirect_uri":"${scheme}://${host}/api/oauth2/callback","server_id":"${server_Id}"}
When I am hitting above in sequence via JMeter I am getting 200 response. Just like JMeter I tried recording in Postman and it worked same, but instead of JSON it gave response in XML format.
It doesn't generate a access_token, it works via session cookies.
My question is - Do I really have API access or it is just browser record n play? If Yes, Does this mean I can get access to any API, if I am a registered user of that application? For ex: Facebook, YouTube or any startup website.
JMeter works on the protocol level. This means that whatever request you are generating. Say a simple browser request or an API call, you can do that easily.
Now the thing is replicating requests. You don't need to record the requests necessarily using the browser. You need to analyze the few things that are required. Say Postman is generating a request. You specify the things you want to send and you use the API Token there. The same things can be specified there as well. It all depends on how you are understanding the concept of request generation.
You simply need to replicate the samplers and the parameters. And the request headers in postman can be replicated here in the same way.
For each HTTP Request Sampler make sure you add a corresponding child HTTP Header Manager config element.
Headers basically tell the server that what client we are using and in what form data is being sent and then server responds accordingly with the information.
What you're recorded is OAuth2 flow and you won't be able to replay it without correlating the dynamic values.
You can have access to Google API or Facebook Graph API given you have proper access_token but I don't think you should be testing them directly, you should focus on solely your application.
So, I am creating an application which will be using flowable.
We can say that once my application starts, it's gonna start a particular process deployed on flowable, proceed ahead accordingly.
So, in a way there will be lot of talking between flowable and other application, but for now suppose I just want to call flowable applications from POSTMAN (outside FLOWABLE).
I have used 3 modules: flowable-idm, flowable-modeler, flowable-task in my application.
Everything works fine when I am starting my deployed process from UI of flowable task, problems come when I want to start the processInstance using REST endpoint.
In flowable-task application, there is already a REST endpoint to start the process deployed: http://localhost:8080/flowable-task/app/rest/process-instances.
Now, if I call this from Swagger of flowable-task application, it works fine.
But it doesn't work when I try to call it from another application or POSTMAN for now (once POSTMAN call works, I can make the same arrangement in code), where I'm doing a basic auth and providing what's required in body.
Also, there is no error or exception displayed on console, I believe that is because of something catching that error or exception and not displaying anything.
However, to overcome the problem of starting process from POSTMAN, I can use REST endpoint http://localhost:9999/flowable-task/process-api/runtime/process-instances, but this is just a workaround, in future if I create new endpoints I would have to figure out a way to call those endpoints.
I saw this post and I guess this guy was also trying to achieve something similar but for flowable-modeler.
It's been suggested to make changes in SecurityConfiguration.java of flowable-task-conf module for my case, but I haven't done such changes before so not exactly sure where to start and how to proceed.
So, my question is how to talk to flowable-applications from outside flowable applications.
Edit:
Forum post about getting exception when imported flowable-rest module in workspace
The flowable-task UI Application is an example application that exposes non public REST API for the UI. However, the application also exposes the full REST API of Flowable.
There is also the flowable-rest application that has the Swagger doc and exposes the full REST API without a UI.
You would want to communicate with those REST endpoints.
The endpoints are under the following contexts:
process-api for the Process Engine
cmmn-api for the CMMN Engine
dmn-api for the DMN Engine
idm-api for the IDM Engine
form-api for the Form Engine
content-api for the Content Engine
For your example you would need to use POST to /process-api/runtime/process-instances for Starting a Process Instance
I am trying to use JMeter to test our Web Application. We originally used LoadComplete to test our Web Application, but because LoadComplete is not able to run on a non-GUI mode, we were not able to use the max stat’s from our test server (strain our 8 CPU’s and 8GB’s of RAM). That is why I moving towards JMeter (https://blazemeter.com/blog/5-ways-launch-jmeter-test-without-using-jmeter-gui).
The test includes logging in, choosing a specific app, do a simple task through this app and then end the recording. The HTTP Requests, which are failing are printing Failed Access on their Response Data on the View Results Tree.
I used the HTTP(S) Test Script Recorder to record each HTTP request. My JMeter project is failing on a few different HTTP Requests, which includes oauthtoken Get Request that includes jessionid="item", a GET resourceLastAccessedTime Request, and a couple GET resourceLastAccessedTime Requests. I tried to follow blazementer's guidance for how to use JMeter for Login Authentication, because these requests seem to be involved with the authentication of each user after logging in and the problem I am getting on Response data for each of these requests on the View Results Tree it says Access denied. (https://docs.blazemeter.com/customer/portal/articles/1743663-how-to-use-jmeter-for-login-authentication-).
One of the steps is to "copy and paste" the Parameters from the Post request after you login to these requests. I can add these parameters to these requests right below where it says Send Parameters with the request, but our POST request only has two parameters (the login name and the password). Is there somewhere else to look for these parameters?
I tried a combination of a lot of different attempts, but I am still unsuccessful (meaning: I moved the Regular Expression Extractor to a few different HTTP requests and I moved which HTTP requests to put those parameters and I have not been successful yet).
Do you know of a URL that could be helpful for this?
Don't trust Test Script Recorder! It doesn't follow any logic while recording your requests. It just records requests processed through proxy as they are. In case you use parameters that can't be defined as constants, the best way would be to rewrite the script manually.
Be patient and spend some hours (only once!) to learn how to construct any test scenarios (even complex) manually using Jmeter GUI. It will save you a lot of time for debugging.
It seems like (just a guess) that your test scenario doesn't contain Cookie Manager item. Based on what you wrote above, it seems like after logging to serer (by sending POST with login and password) it sets some cookies by Set-Cookie HTTP header. These cookies should be included in every next request as a prove that you successfully logged in before (the most common logic for simple web applications). So, if you get Access Denied, means you didn't include appropriate cookies in test request. Use Cookie Manager for that.
Feel free to ping me in case you need any assistance.
Jmeter help manual is all you need to know about how each element works.
P.S.: Jmeter also can generate distributed load from multiple slave servers, in GUI and CLI modes both. So, in case you need to stress your server yout, Jmeter is the best choise.
And welcome to Jmeter users family! Good luck.