Using Postman and Postman Interceptor to authenticate a session cookie based GraphQL API
Tags: postman, cookie, graphql, apollo
Published: 2023-02-09 18:28:25

---
title: Using Postman and Postman Interceptor to authenticate a session cookie based GraphQL API
published: true
description: Using Postman to authenticate a session cookie based API
tags: postman, cookie, graphql, apollo
# cover_image: https://direct_url_to_image.jpg
# Use a ratio of 100:42 for best results.
# published_at: 2023-02-09 15:37 +0000
---

## Context
I once had to authenticate requests made from [Apollo Studio](https://studio.apollographql.com/) to my local development server. The locally running GraphQL API was using session cookies for authentication. While there were workarounds and configs in order to set cookies correctly for requests sent from Apollo Studio, I wasn't able to reliably make it work. Also, I didn't want to change the cookie configs in my server as it would mess with my frontend setup. 

## Solution
I used Postman Interceptor to intercept cookies from the frontend. So every time a user logged in, Postman Interceptor would capture the appropriate cookies and store it. Now on every graphql requests made via Postman the stored cookies would be sent and user would get access to protected resource.

## Steps: 
* [Install](https://www.postman.com/downloads/) and connect Postman to the local graphql server.
  * Follow the steps from this section: [Sending GraphQL queries in the request body](https://learning.postman.com/docs/sending-requests/graphql/graphql/#using-postmans-built-in-support-for-graphql) and use your local server url: [http://localhost:5000/graphql](http://localhost:5000/graphql) as URL endpoint.
* [Install](https://chrome.google.com/webstore/detail/postman-interceptor/aicmkgpgakddgnaphhhpliifpcfhicfo?hl=en) Postman Interceptor for Chrome
  * Go through the section [Syncing cookies with Postman Interceptor](https://learning.postman.com/docs/sending-requests/capturing-request-data/syncing-cookies/#syncing-cookies-with-postman-interceptor) and add `localhost` as the domain.
* Next login to the frontend(in Chrome) as a privileged user (eg. at http://localhost:3000). The cookies set in the browser will be captured by Postman.

![captured-cookies](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9pjdd1isnmby0co3yncz.png)

* Next goto Postman and run a privileged query (which should not be available to unauthenticated/public users). The data is returned in the body and the relevant cookies are sent along with the request.

![success-response](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s736aj3lt19scdu5g38m.png)

![cookies-set-in-the-header](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a1z2jx08kaalzf35927f.png)
* The cookies will be automatically removed/updated once we logout or login as a different user.


References:
* Setting up cookies in Apollo Studio
  * [Apollo Server 3 Cookie Issue #5775](https://github.com/apollographql/apollo-server/issues/5775)
  * [GraphQL, Apollo Studio, and Cookies](https://blog.devgenius.io/graphql-apollo-studio-and-cookies-5d8519d0ca7e)
  * [Connecting and authenticating with the Explorer](https://www.apollographql.com/docs/graphos/explorer/connecting-authenticating/)
* Setting up Postman
  * [Querying with GraphQL](https://learning.postman.com/docs/sending-requests/graphql/graphql/)
  * [Capturing and syncing cookies](https://learning.postman.com/docs/sending-requests/capturing-request-data/syncing-cookies/)