SGrush178250 (Community Member) asked a question.
Bearer tokens in API scans
We plan to use Veracode API Scanning, but there is no clear example on how to set up an example where a specific endpoint returns a Bearer token (in our case by setting a cookie). I see a number of examples using OAuth2 flows, but our simple case has the user hit the authentication endpoint and reuse the cookie across their API session.
Does Veracode API Scanning support specifying the source of bearer auth tokens? Or will I need to use scriptable request modification on every call?
.png){kind=logo}
I have same questtion.
Bearer token authentication involves three things:
The Sitecore Identity (SI) server. The SI server issues access tokens in JWT (JSON Web Token) format by default. Every relevant platform today has support for validating JWT tokens. You can consider access and bearer token as the same thing.
An API application. McKesson SMO
An MVC client application. The application requests an access token from the SI server and uses it to gain access to the API.