CODEWITHSUNDEEP
pythonpython-requestsbasic-authentication
madmatrix
madmatrix

Reputation: 265

Basic Authentication returns 401 Client Error but works in postman

I have gone through number of similar posts related to firing GET requests with Basic Auth (eg: Python, HTTPS GET with basic authentication), still can't figure out the problem. I keep getting the error requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url

With the same credentials, headers tried the same in postman it works as expected. Verified that base64encoded value for the api_key, password is exactly same as the value used in postman, so I don't think its encoding or resource access permission problem.

python -V
Python 3.6.4 :: Anaconda, Inc.

Approach 1

api_key = 'some_api_key'
password = 'some_password'
headers = {'accept': 'application/json'}

url = 'https://test.access.com/this/url'

api_key_password = "%s:%s" % (api_key, password)

b64_encoded = b64encode(bytes(api_key_password, 'utf-8')).decode("ascii")

headers['authorization'] = 'Basic %s' %  b64_encoded

response = requests.get(url,
                        headers=headers)

if (response.ok):
    json_data = json.loads(response.content)
    print (json_data)
else:
    print (response)
    response.raise_for_status()

Approach 2

api_key = 'some_api_key'
password = 'some_password'

url = 'https://test.access.com/this/url'

headers = {
    'accept': 'application/json',
}

response = requests.get(url, headers=headers, auth=(api_key, password))
print (response.ok)

if (response.ok):
    json_data = json.loads(response.content)
    print (json_data)
else:
    print (response)
    response.raise_for_status()

Can you please provide some pointers?

Upvotes: 2

Views: 6193

Answers (2)

nooclearwessel
nooclearwessel

Reputation: 101

Older post but I had a similar issue. Postman will cache your JSESSIONID. Be sure you are clearing out that cookie while testing. If you are hitting an API that requires a login API call to establish a session before you can make subsequent API calls, this Postman behavior can produce a false sense of security.

In this situation with Python requests, it can be handled with code similar to what I've provided below:

import requests,json

loginAPI = "https://myapi.myco.comv/someuri/someuri/users/login"
someHTTPGetAPI = "https://myapi.myco.com/someuri/someuri/someservice"
username = "myuser"
password = "mypass"

headers = {
    "Content-Type": "application/json",
    "login": username,
    "password": password
}

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
verify=False

session = requests.Session()
sessionResponse = session.get(url=loginURL,headers=headers, verify=verify)

if sessionResponse.status_code == 200:
    getResponse = session.get(url=someHTTPGetAPI)

    if getResponse.status_code == 200:
        responseJSON = agentStatus.json()

Upvotes: 0

bensijons
bensijons

Reputation: 86

I had a similar issue (although in .NET Framework).

In my case the reason was that I was using the url without a forward slash in the end and the API apparently does not support that.

So https://test.access.com/this/url

Throws 401 error Unauthorized

but

https://test.access.com/this/url/

Returns 200 OK.

Upvotes: 5

Related Questions