# Is there a way to do form based authentication in Postman?

**URL:** <https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218>\
**Category:** Help Hub\
**Tags:** authentication\
**Created:** [October 29, 2020, 5:48am UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218 "2020-10-29T05:48:35Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![gotestman](https://avatars.discourse-cdn.com/v4/letter/g/76d3ee/32.png) [@gotestman](https://community.postman.com/u/gotestman)\
**Post date:** [October 29, 2020, 5:48am UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/1 "2020-10-29T05:48:35Z")

</div>

I’m trying to achieve what I’m able to do via Java **REST-Assured** code below:

RestAssured.given()  
.baseUri(“[http://internal-webserver](http://internal-webserver):port”).auth()  
.form(username, password, new FormAuthConfig("/authlogin.form", “username”, “password”)  
.withAdditionalField(“login-form-type”))  
.with().contentType(ContentType.JSON)  
.body(reqJSON)  
.post("/rest/testresource");

Ref: [Read more about 4. Using Form Authentication](https://www.baeldung.com/rest-assured-authentication#form)

Basically I’m trying to know if there is a way to do such Login Form Based Authentication using Postman.

---

<div class="post-metadata">

**Author:** ![odanylewycz](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/odanylewycz/32/3240_2.png) [@odanylewycz](https://community.postman.com/u/odanylewycz)\
**Post date:** [October 29, 2020, 12:04pm UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/2 "2020-10-29T12:04:25Z")

</div>

Hi @gotestman,

Looking at this, it seems to just be basic authentication (unless you include the addition of a CSRF token, which I don’t see here)

You can try using Basic Auth on that endpoint to see what you get, and if it works.

Otherwise, you can try doing this authentication and then opening up your developer tools to see how the HTTP request and response look, and then try to mimic that within Postman.

---

<div class="post-metadata">

**Author:** ![gotestman](https://avatars.discourse-cdn.com/v4/letter/g/76d3ee/32.png) [@gotestman](https://community.postman.com/u/gotestman)\
**Post date:** [October 29, 2020, 6:36pm UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/3 "2020-10-29T18:36:30Z")

</div>

Hi @odanylewycz, Using Basic Auth we can only set username & password but how to specify different endpoints for form login authentication and for the actual POST request?

---

<div class="post-metadata">

**Author:** ![allenheltondev](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/allenheltondev/32/31738_2.png) [@allenheltondev](https://community.postman.com/u/allenheltondev)\
**Post date:** [October 29, 2020, 7:07pm UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/4 "2020-10-29T19:07:12Z")

</div>

hey @gotestman,

You’d want to hit the endpoint for getting your auth token in a pre-request script so it runs before your regular request.

The prerequest script would hit the auth server, get a token back, then save the token as a variable that the request would then use.

---

<div class="post-metadata">

**Author:** ![gotestman](https://avatars.discourse-cdn.com/v4/letter/g/76d3ee/32.png) [@gotestman](https://community.postman.com/u/gotestman)\
**Post date:** [October 29, 2020, 7:30pm UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/5 "2020-10-29T19:30:14Z")

</div>

Thanks @allenheltondev, I’ve tried to do that in the pre-request script but I wasn’t getting the authentication pass same as I was able to get it via REST-Assured. Could you please provide a sample script for me to try?

---

<div class="post-metadata">

**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\
**Post date:** [October 29, 2020, 8:02pm UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/6 "2020-10-29T20:02:30Z")

</div>

What have you tried so far?

It sounds like you had something in place, which part of that isn’t working?

---

<div class="post-metadata">

**Author:** ![gotestman](https://avatars.discourse-cdn.com/v4/letter/g/76d3ee/32.png) [@gotestman](https://community.postman.com/u/gotestman)\
**Post date:** [October 29, 2020, 9:20pm UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/7 "2020-10-29T21:20:34Z")

</div>

I’ve tried something like this in the pre-request script

```auto
pm.sendRequest({
    url: pm.environment.get("auth_form_url"),
    method: 'GET',
    header: {
        'Authorization': 'Basic xxxxxxxxxx==',
    }
}, function (err, res) {
    pm.environment.set("access_token", res.json().token);
});

```

But getting Bad Request 400 error code.

---

<div class="post-metadata">

**Author:** ![gotestman](https://avatars.discourse-cdn.com/v4/letter/g/76d3ee/32.png) [@gotestman](https://community.postman.com/u/gotestman)\
**Post date:** [October 29, 2020, 9:54pm UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/8 "2020-10-29T21:54:51Z")

</div>

This is how the source of login form actually looks:

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/7/6/76b1924e5597fcd200f6fd1f5009846c4625680e.png)

---

<div class="post-metadata">

**Author:** ![allenheltondev](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/allenheltondev/32/31738_2.png) [@allenheltondev](https://community.postman.com/u/allenheltondev)\
**Post date:** [October 30, 2020, 11:20am UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/9 "2020-10-30T11:20:46Z")

</div>

I think part of your problem might be that you’re using GET instead of POST.

Have a look at the [blog post I did](https://www.readysetcloud.io/blog/allen.helton/how-to-automate-oauth2-token-renewal-in-postman-864420d381a0/) on this topic.

---

<div class="post-metadata">

**Author:** ![odanylewycz](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/odanylewycz/32/3240_2.png) [@odanylewycz](https://community.postman.com/u/odanylewycz)\
**Post date:** [October 30, 2020, 11:31am UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/10 "2020-10-30T11:31:27Z")

</div>

Thanks for sharing more information.

From what I’ve seen, it doesnt look like we have enough to go off of.

Before proceeding further, it would be worthwhile to change your pre-request script to use a POST instead of a GET Method, as noted by @allenheltondev. This is even mentioned in the documentation you referred to:

> When the user submits the form, the browser executes a POST request with the information.

If that doesnt work, the best course of action is to investigate the HTTP request in transit. Using Chrome Developer Tools (or whatever browser dev tools), you can do this, and simply record the network traffic before authentication, and then stop it. You should see how the HTTP request is formatted, and that should provide enough insight as to what you need to create within Postman.

In addition to that, I noticed in your original post that you have a request body in JSON:

`.body(reqJSON)`

Would you happen to know how that JSON actually looks? Chances are thats the body you need in your Pre-Request script too, in order to perform your authorization.

With Basic Auth (generally speaking), you dont need to get a token as the token itself if the combination of `base64(username + ':' + password)` thats used in every request that need authorization. With the access token, your web service should be providing that for you upon authentication at the auth endpoint.

If you can provide those extra details mentioned about, we can get closer to authenticating to your web service 🙂

---

<div class="post-metadata">

**Author:** ![gotestman](https://avatars.discourse-cdn.com/v4/letter/g/76d3ee/32.png) [@gotestman](https://community.postman.com/u/gotestman)\
**Post date:** [October 30, 2020, 8:28pm UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/11 "2020-10-30T20:28:55Z")

</div>

Thanks for your replies @odanylewycz & @allenheltondev.

Yes, I’ve tried POST as well with Basic Auth using the base64 encoded string as mentioned and also body using form-data & x-www-form-urlencoded types in the pre-request script for auth\_form request. It is basically the java spring security authentication that I’m trying to do in Postman. After this HTML form based auth request, I’ve to send the actualy POST request with json body to get a json response at a different endpoint.

---

<div class="post-metadata">

**Author:** ![odanylewycz](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/odanylewycz/32/3240_2.png) [@odanylewycz](https://community.postman.com/u/odanylewycz)\
**Post date:** [November 2, 2020, 6:38pm UTC](https://community.postman.com/t/is-there-a-way-to-do-form-based-authentication-in-postman/17218/12 "2020-11-02T18:38:13Z")

</div>

You’re welcome.

I appreciate the continued explanation for the java spring security authentication. Sadly, I still don’t have enough information to go off of, and I’m not certain how else I can help. My best bet is still to see the request happen in transit for authentication using web developer tools, and that should be enough information for how to format your authentication request in Postman.