Skip to content
Postman API Testing Tips

How To Use Csrf Token In Postman

API Testing Blog

Understanding CSRF Tokens and Their Importance

CSRF (Cross-Site Request Forgery) is a type of web security vulnerability that allows attackers to induce users to perform actions on a web application without their knowledge. This is often achieved by sending malicious requests to the server that appear to originate from a trusted source.

CSRF tokens are used as a countermeasure against this attack. These are unique, secret tokens generated by the server and sent to the client along with the HTML response. On subsequent requests, the client must include this token in the request header or as a parameter, verifying that the request originated from the client and not from an attacker.

How to Use CSRF Token in Postman for API Testing

Postman, a popular API testing tool, provides the flexibility to work with CSRF tokens effectively during API testing. Here’s a step-by-step guide on how to use CSRF tokens in Postman:

1. Obtain the CSRF Token

The first step is to obtain the CSRF token from the server. This can be done in several ways:

  • Check HTML response: Some applications include the CSRF token within the HTML response, usually in a <meta> tag.
  • API Endpoint: Many APIs offer dedicated endpoints to fetch a new CSRF token.
  • Cookie: The CSRF token may be stored within a cookie called ‘CSRF-TOKEN’ or similar.

Example: Assuming the CSRF token is stored in a cookie called ‘XSRF-TOKEN’:

// Fetch the token from the cookie
let token = pm.cookies.get("XSRF-TOKEN").value;

2. Send the CSRF Token in Subsequent Requests

Once you have the CSRF token, you need to include it in the subsequent requests you send to the server:

2.1 Using Headers

Send the token as a header value, usually named ‘X-CSRF-TOKEN’ or ‘CSRF-Token’.

Example:

// Pre-request Script
let token = "your_csrf_token"; // Replace with your obtained token
pm.request.headers.add({
  key: "X-CSRF-TOKEN",
  value: token
});

2.2 Using Request Parameters

Pass the CSRF token as a query parameter in the request URL.

Example:

// Pre-request Script
let token = "your_csrf_token"; // Replace with your obtained token
pm.request.url.query.add({
  key: "csrf_token",
  value: token
});

2.3 Dynamic Token Retrieval (Pre-request Script)

You can automate the process of obtaining and sending the CSRF token using Postman’s pre-request scripts.

Example: Fetching the CSRF token from a dedicated endpoint:

// Pre-request Script
pm.sendRequest({
  url: 'https://example.com/csrf', // URL to fetch CSRF token
  method: 'GET'
}, function (response) {
  // Access the token from the response
  let token = response.json().token;
  pm.request.headers.add({
    key: "X-CSRF-TOKEN",
    value: token
  });
});

3. Test Your API Requests

Now that you have properly included the CSRF token in your requests, you can start testing your target API endpoints. Postman will send the token along with your requests, ensuring secure communication.

Example: Send a POST request to create a new user resource, including the CSRF token:

// Pre-request Script
let token = "your_csrf_token"; // Replace with your obtained token
pm.request.headers.add({
  key: "X-CSRF-TOKEN",
  value: token
});


// POST Request
pm.sendRequest({
  url: 'https://example.com/users',
  method: 'POST',
  body: {
    name: 'John Doe'
  }
}, function (response) {
  // Your assertion logic
  console.log(response.json());
});

Best Practices for CSRF Token Management in Postman

  • Store the CSRF token securely: Avoid storing the token directly in your test scripts. Instead, retrieve it dynamically using pre-request scripts or environment variables.
  • Utilize pre-request scripts: Automate the process of obtaining and sending the CSRF token for every request.
  • Test various scenarios: Verify that your application handles CSRF tokens correctly in different scenarios, such as user login, form submissions, and API requests.

By following these steps and best practices, you can effectively manage CSRF tokens during API testing using Postman, ensuring both security and accuracy in your test results.

API Testing Blog