Kong Insomnia Stream, 2 Aug 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Insomnia Stream 2022 08 02 - How to Save Variables from Requests

Description

On today's stream we took a look through some community messages on the Insomnia Community Slack. Primarily, we looked at https://insomnia.rest/plugins/insomnia-plugin-save-variables and found a way to simulate CSRF token refreshing in such a way that regular request chaining doesn't allow. Cool stuff!

A weekly stream focused on Insomnia's open source community.

Join us on the #stream channel over on the Insomnia community slack: https://chat.insomnia.rest

A

B

We gotta change that the it's so it's so pumping. It gets right to the to the crescendo of the beat and then.

C

I I think it's a bit annoying at this point. I think.

B

The the music you should get new music, you're saying or the where it comes. We should get new music.

C

Oh okay, we can leave it up to two folks that watch the stream. What now, but I think.

B

Okay, here's an idea: we could use insomnia to make music, we could add audio functionality and then we could have put like a sequencer in there. We could. We could do this, I'm gonna start. I can start a branch right now. You want to um because.

C

You think it is, you think it would be possible, but what would it do? Would you play like midi sequences or something.

B

um Yeah, of course it would be possible yeah, it would be possible. You know there's. That is an interesting idea, though, like what is what is a way that you could have insomnia play music like.

C

um The first thing that comes to my mind is something I remember seeing like on um on a presentation a few years ago, and I think it was about you know using some sort of uh library to generate uh frequencies and whatnot and play sounds. I don't know I think, or or we could take, but like the the far route and connect uh to some uh midi uh thingy over over the api. Like I think I have this.

B

Raspberry pi, I think you have a genuine question now that that's come from this. So let me uh let's share my screen here so like here, so um I am on the beta. Aren't I I'm on the latest beta yeah, okay. So the question is, uh if I play with what would be something that I can go to like youtube, we have stalin here: hey stalin, how's it going.

D

Hey everybody, I'm good.

B

So I'm trying to see like if I go to youtube.com. Oh, is this going to have like some like it's always funny to go to something like youtube? Oh there's, no! Okay,.

A

B

Freesound.Net or something like that or.

C

I think also you need to check in the preferences. I think we have a setting there for disabling javascript or something on insomnia itself.

B

Oh really, okay, I would just want to like I don't know where to go. I just want to okay englewood shire. What is this.

B

Okay that'll, do I don't care? So let's go here.

B

uh Okay, sort of okay where's, the where's, the setting disable json. It's not enabled so has this got some kind of.

C

It's probably some html5 magic in there right here.

B

There's gotta be some html5 magic, whoa, okay, we're in full on streamer mode, I'm just curious if we could what would be like a like a oh man. I've seen these before like uh css piano somebody here is this a thing, but it doesn't make sound. Oh, let's try one more okay, we're going to give up on this very soon. If anybody, uh okay, let's, let's try last try.

C

Oh yeah, okay, are we going somewhere.

C

I wonder: how does that work.

A

What, yes, how does.

C

It work, how is it working.

B

Home audio, so it just plays a sample every time. You click that it plays a sample.

C

But the um the audio is coming through from insomnia right same way would come from a browser.

B

um Oh, I have a. I have.

B

A um yeah it's coming, can you hear it? You can hear it right. Everyone.

C

Here I think we can hear it stalin. Can you hear it.

A

D

Yes, I can hear it, but with css, how do they make songs yeah, that's interesting.

B

I just typed css piano, because I know people like do that kind of thing they make like a little synthesizer, but anyone anyway, uh hey everybody. Welcome to the insomnia street, we're gonna, we're gonna, make it work. Okay, we're gonna! There are people watching like stop. Trying to make the sound board happen. um The you can see on your screen, chat.insomnia.rest um you! uh You could go to this document. If you go to our community slack you'll find your way to this document.

B

It's pinned to the stream channel on the community slack and on this we talk about what the priorities are for the stream like what the stream is for so generally for live requests. That's always the! Even. If you come in in the middle of us working on something that's a high priority, then we have things on the github uh for insomnia that have a stream label. So we'll look for those items. We have a community slack and we have just regular github issue triage, which we've done before it was kind of fun.

B

I would like to do again sometime, however, despite this order, I thought you know what I what I do is. Let me bring drag my slack window over here. Oh I closed it. Sorry, slack, okay!

B

So what I did is um you know every every week I I post the the item here in this general channel of our insomnia community slack for what's going on, and I notice that there's a lot of things here that are like unanswered questions that we're not responding to people on and like what was that seven or so in a row.

B

So I thought that we should. We should take a take a moment and answer try to answer some of these questions. Yeah. Does that sound good to you, philippe.

C

Sounds good to me, yeah.

B

All right, I love the. I love our community because usually people start with something very nice like this, um so this person says hi everyone. First of all, I want to thank you and your team for the amazing app which I've been using for years now, we're very grateful for you to use it. Thank you.

B

I got some bug that didn't allow me to switch to post when I created a new request. Nothing was happening. It was just getting stuck on git and I tried to manually input git into the custom request form, but it didn't help either. After that I restarted the app and now I see this can't do anything.

B

Okay, well felipe. I bet you're thinking, one of the things that I'm thinking um uh it's called uh request, method uh or method drop down.

D

B

That's what it's called.

A

A

B

Did here, uh method drop down does not change okay, so uh the first thing comes to mind is a bug you mentioned we recently fixed in here. um Let's try to link this person to the.

A

C

Exactly um you can just click on on one on like the beta 7 and just re-edit, the uh the url. If you want to direct them to a stable.

B

I don't think I want to try the beta, because I don't think this was 20 days ago we haven't had a g8 since then.

A

Yeah yeah, it makes sense to me on.

B

The beta here regarding the blank screen man, how long ago, was this july 27th that that was a while ago.

C

Or I mean I remember seeing that bug, but it was a while ago, yeah.

B

B

For oh, it's not blank, it says, render.

C

Yeah yeah, it sounds like it says, like something: unexpected.

B

A

B

um Is it further with a? U or farther, I think further is because is metaphorical distance right, um I don't know, maybe.

C

B

C

B

Well, are you, are you, would you consider yourself, a native english speaker, philippe you learned.

C

Not a chance, no.

B

Oh really, you could have fooled me. I mean you, don't you didn't learn when you were a child in school.

C

I don't know how to answer that. The the thing is, uh I'm part of the generation that learned a lot of english from cartoons, video games and all that sort of uh crap. It was only after. It was only recently that kids need to learn english from the very like first grade, or something like that, because officially I only started learning english like from the fifth grade onwards, something like that.

C

D

C

Consider myself a native speaker by far, especially if my brain is tired. I will start uh you'll notice, more an accent.

B

I notice I mean you, don't you have a good you roll your r, sometimes, which is fun um not like that.

B

uh Okay, so uh where was okay getting lost here? Okay, so render failure. Unexpected string- um and I didn't see anything more in the app regarding um anything with that.

B

uh Let's look for render failure, though, actually.

B

Render failure? Okay, it's an error boundary at the top of the yeah. It's just an error boundary unexpected.

B

um Yeah unexpected, no there's, not even a thing that says unexpected and has a parameter, so I don't know where that could have come from okay. Well, let's see if the beta.

C

If it helps them, yeah yeah.

B

uh Please let us know okey-dokey one down um and I'm assuming yeah. I think will's triaged, that one, so that's good. Okay, hi boiling soup pie boiling soup. um We can take the chat thing off the screen here. I guess so. They say my server returns, a new csrf token, with every request, and I need to update the request header to always use the latest token. Is there a way to script this, so it updates automatically?

B

C

I think I replied that person. Can you check? No? No okay. Then I replied to someone else that had a similar thing.

B

Yeah, I'm gonna respond here so returns a new csrf token, with every request. I wonder if we can make a.

B

I wonder if we can demo this somehow or we can make like a minimal use case for this. Do you know what I mean.

C

I mean minimal use case. You can uh spin up two requests on insomnia. They will.

A

C

And in one of them, you're just extracting something from the response and then.

B

Well, but that's the thing is: is that that's not what's happening, it's a new token for every individual request. Oh yeah, so maybe request chaining actually won't work here, because request chaining is all about one request, feeding information into another request, but this would not work for this use case, because each request requires its own new token.

C

um Then probably I would solve this with. I think one of the plugins that stalin mentioned a couple streams ago, the one that keeps updating a variable, something like that.

A

An environment variable I mean.

B

I'm not, I guess, I'm confused. Is it okay? We gotta, like we gotta get excalidrago in here.

B

um uh I wonder what I have an excel draw: oh nothing, because I'm in the insomnia stream account. Okay, that's convenient! Okay! So um there's like a there's, a request that happens.

A

B

Request: okay, let's make this not so big, then all right can I zoom.

A

C

If you double click on on the square thingy it should.

C

B

Know: okay, it works.

A

B

A I have a request um and then I have a. I have a like a response right. What is this copy? Paste? Okay,.

B

And then the request uh goes to the server.

B

So from here we go to the server and from the server we go, the server returns the response, and then we have uh insomnia is in here somewhere. Let's make it a circle because we're like that's what we are got the little insomnia.

B

um Okay, I love that you laugh at my jokes. Thank you very much. We're a.

A

C

B

B

It always feels a little weird okay, so insomnia has a request that it creates sends to the server and the server sends it back to insomnia. This is the this is the flow.

C

And in the response we get a csrf token, probably in the in the headers or in the response body right.

B

So uh we're assuming.

B

So let's make this red or something okay, so so the response contains a csrf token. Actually, the server the server creates a csrf token, um and then the this guy passes it here and this guy passes it here. So what I think is happening is that um maybe yeah does this look right to you.

C

Yeah, can we google really quick, what's a csrf token, just for the folks at home that don't know what to say? Okay,.

A

B

Oops and my I'm beating my typing buffer today.

B

Okay, let's see what these say: um okay, so there's a there's, a thing called a. I can explain it a little bit. There's a thing called a cross site request, forgery attack and what that means. Is you make a request to a server pretending to be someone that you're? Not I can do uh my favorite thing to do with insomnia is actually demonstrate. Cross-Site, request forgery, so so here I'll do it right now. So there's a uh I don't know um this thing tokens!

B

Okay, I don't know what this is. It doesn't really matter, it's a request that was made because I'm on this webpage, port port, swig swigger- I don't know ports, I don't know so. Portswigger.Com makes a request with my web browser. I can copy as curl, for example, on this request, which has all these headers. So I want to show you before we paste it into insomnia. I want to show you what we're going to paste we're going to paste a thing that looks like this okay.

B

This is a this is a curl request and we could make this curl request. I think. um Well, ideally, this is from you know, google. I could make this chrome request here and it's going to return me some data, so that's technically um I mean you would need to have a server. That's sending this. I guess some people would argue. This is not cross-site request. Forgery! Yeah technically, but you know I'm a client, but it doesn't doesn't really make a big difference in that respect.

B

So in insomnia I could come over here and I can paste right in the url bar, it's really cool. Remember. I still have my curl thing uh in my clipboard. I can paste it there and what it did. Is it parsed out all of these different tokens and I can send the request and get the response.

B

So there's no css here, okay, but um this is the page that I was just looking at and this works even for uh like if you're logged in with something or you have some like oauth flow that you've gone through, and you want to just make a request as though you're from the browser I use that trick all the time to investigate stuff, because sometimes you may hit the situation where it's like.

B

Oh, uh like I don't want to do, I want to use all the same information, but I want to use like csrf tokens like get token or something like you know. I don't know it's not going to say that client id um you know or something you want to. You want to do something else. That's slightly different from what the website actually does. This is effectively uh you know hacking right.

B

I mean we're telling we're telling the uh server that we are someone we're not we're telling that we came from a place that we didn't come um so you can. You can use that to your advantage and web browsers will not allow you to make such a request.

B

So there's no way with, like the fetch api, for example, there's no way for here oops, let's we don't need to preserve log, there's no way for here for me to say, like uh fetch and then like some, you know some url and then for me to say, like you know, origin, uh you know or to say that I came from somewhere that I didn't the browsers have.

C

A different browser, yeah.

B

The browsers have a security model that prevents any such requests from ever being made period period, but if you have a tool like insomnia or curl on the command line, or you write your own server, you can do whatever you want so to combat that a csrf token is a unique secret, unpredictable value, that's generated by the server side, application and transmitted to the client in such a way that it's included with a subsequent hd http request made by the client when the later request is made.

B

The server side application validates that the request includes the expected token and rejects the request if the token is missing or invalid.

B

So um this is uh see. Okay, let's just keep reading csrf tokens can prevent csrf attacks, which is the thing I was just describing by making it impossible for an attacker to construct a fully valid http request suitable for feeding to a victim user.

B

Since the attacker cannot determine or predict the value of the user csrf token, they cannot construct a request with all the parameters that are necessary for the application to honor the request. So imagine that I'm doing this thing that I was explaining before what you would effectively want to do. If you were trying to attack someone is you would send them a request like to their bank or something that would be the api recall that is necessary for the bank to like transfer money. Let's just say, like a really easy.

B

Very straightforward example like that, so you're trying to steal money from their bank account. Well imagine if, on that request and on every request that you make to that bank's api, they send you a token and on the next request, you need to send them back that token.

B

I have no way to get that token. As the author of a um as a of a script like this, and because I have no way to make that I mean not, I wouldn't say I have no way, because there is, you know, like the user has a way to do it.

B

Therefore it's possible, but it makes it way harder like way way way harder to make a script that you can just uh inject on a page to attack someone, because, ultimately uh you don't have the token that's required and like we just read, the server will reject any request. That is either missing the token or has an invalid token.

B

So let's go back to excalidraw. So this is. This is request request one: okay, that's one insomnia! uh Then what happens is we we? uh We can copy all this um and we're gonna send uh here. Let's do this, so let's make this okay so csrf token. Let's do a five um do that and then.

B

Is this the right way to depict this? I don't know we'll see and then let's make another one here.

B

So request two there's probably a better way to model this, I'm just we're just doing.

C

B

So what we'll do here is we'll color this one, a different color so we'll make these like. uh I don't know green.

B

So what you see here is that on every on request, one we created the csr csrf token, and then we got back to insomnia and then on request two. It sends in the csrf token, from the last request.

B

um We'd also need like a white one of these guys to really beat the the model here all right. So that's that's! What's going on. um I guess we need another one here as well.

B

Does that sound right to you philippe what I'm describing.

C

Yeah sounds about right.

B

um So the problem is: is that request chaining? I don't think request. Chaining would do it because the the chained requests like after the first after you get the first token the chain request needs to needs to have it. So I don't know I mean.

C

There is, there is a setting on yeah, but you're right, channel requests wouldn't do it. We would need something that whenever we get a response, it would parse the response and set some new valuables. For example,.

B

A

That's right because.

C

Any response would edit an environment variable which we would then use as a header or something like that in any request, you know what I mean: yeah.

B

Stalin, what do you think about this? Does this sound like we're somewhere.

A

D

It's better to save it and available and reuse it in the next request.

B

um Let's look in the plug-in hub uh there's one.

C

Save variables or if you start writing variables, I think that might be that one.

B

I'm going to open that one: oh, we don't have double right click or whatever uh csrf I'm just looking. I'm gonna plug in for setting x, x, srf token header in the cross site request. Forgery did laravel, really call it xsrf because cross the c stands for cross. Is that what happened?

B

A

B

Not active anymore wait.

B

We're gonna take a sidebar, I yeah, I I'm never. I never stopped being amazed at the design decisions of laravel x. What is this.

B

A

B

Current csr token is an encrypted xsf cookie that is included with each response generate the framework you can use this cookie. So what's the difference between that and csrf.

A

C

I I guess the x is like special, especially.

B

All right, we won't get stuck on it. Oh wait! We will get stuck on this, though. Okay, let's, let's look really quick. It's an alternative to request. Chaining.

C

In the meantime, stalin do you recommend any other plug-in that we should use for for variables? No.

D

I already used this. I guess yeah, okay,.

B

Request b also return returns. A similar id token you wouldn't have you'd have to create from response to save all the same variables.

A

B

Okay, let's try it do. I have it installed. uh Let's make a new request: plugins uh save variables. I do okay, so we're going to come over here, mockman.org echo and then um that should work yeah. It does and then we'll come over here. Let's just do plain text, so we can do save variable.

D

No, I don't think you can use so you will have to set it in the header. So.

A

You will be passing.

D

Yeah, you have to pass your kiss first right. So since you are using echo, you will have to pass in some value.

A

D

Only you will get as a response right right.

B

D

I mean before that, it's better you send some data first and then set the plugin. Oh.

B

We have uh hey robinson, hey, uh have you used this this plugin before uh no we're trying to we're trying to figure it out so uh stalin? Can you can you walk me through it one more time? I think so. I put the save variable here in the in the header.

D

No, uh what I meant was you were using the echo right yes, but you were not sending any data yeah.

A

D

Is nothing right right? Okay, so now we have a data, but.

A

D

B

Okay um I'll say uh like, ultimately, what I want to do is I want to have a header, okay, okay, watch, this um csrf.

B

um Js eval, so let's do this, we can. We can simulate it this way we can say new date, um yeah sure. That's fine,.

C

Why don't you use instead of jsu, while the stamp thingy that we haven't.

B

Oh, hey, yeah, that's fine!.

C

uh uh You should have one for unix or something or yeah.

B

Okay, so we'll see here that when we look at this wow there's a lot of stuff um time stamp is gonna be csrf thingy. Is this like an invalid okay.

B

Why is it not returning.

C

Either that or or the echo doesn't do it for heathers.

D

Most probably try starting it with an x, usually custom, middles start with an x. Oh.

A

A

C

Wait search for slash headers. I think we do have one for slash. Headers, headers,.

B

Returns a list of headers used in the request we do, um but why doesn't echo sports compression.

B

um Oops echo body and content type, yeah, you're right so headers. Do this see x, powered by is that right? It's not there. Okay, let's look again.

A

B

um I'm sorry this is small for anyone looking on their phone later. No, um yes, it was there. It was there yeah, it's powered by that. I don't see it. Just stay. Stop in the middle stop x, powered by second one down there you go, but but.

C

D

Sorry, you said x, powered by.

B

Yeah yeah, no, I was just reading sorry. I was just reading to myself but yeah. um Well, we could do header with the name.

B

X, custom, header, okay: why doesn't this work? This is supposed to work returns a list of all headers, using the request, as as well as the total number of bytes from the start of the request messages, including the header body, okay, so x, custom, header and it's going to return.

C

On the response body.

B

And x, custom: oh, maybe maybe it's because this is not a string. What is a string? Okay, let's try again.

D

uh Why don't we try sending the uh body as a json instead of plain text, sure.

A

That's the response body as philippi mentioned, yeah yep.

C

Exactly check check on the preview tag, because I think it is showing up on the that's just the way mock bin works. You should see it.

D

There oh yeah yeah, yeah yeah. It was supposed to be there.

C

Yeah, like x, custom header, there line 40.

B

Yeah, okay, I mean.

C

For the purposes of the example, we could try parsing it from there instead of.

B

Parsing it yeah all right. Let's, let's keep moving with it. Let's try to do it so then um we're gonna try to well. How do we use save variable for that.

D

Okay, so in this scenario we can oh yeah, uh can you is there? Is it an extra nested json? Yes,.

B

What is the root? um It's? Okay, instead letters.

B

um Oh, what's the syntax um for books.

A

C

Probably the last one there the match. Okay, I don't know.

B

So, oh cuz, it okay, that's annoying! Okay, so store headers um at name dot match custom.

B

There we go nice.

C

B

B

Okay, it's just it's just that it returns an array. Always so that's our that's! Our lookup.

B

um If I send it again, I'm going to get different values every time, so that's good! We can get rid of this. So, oh, maybe.

D

We should have used.

A

B

X, custom, sorry, okay, right so.

D

We would like to add a new header, too. Okay,.

A

Which what it would be, I think.

C

It's a variable.

A

B

B

Say variable oops, save, say variable.

A

No, that has to be the.

D

Key that has to be the key itself. What we're doing before, what's right.

D

A

D

What we specify.

B

A

What the key the.

D

A

So it goes through.

D

Yeah that that will stay yeah.

B

um My value, okay, so.

D

Outside except my value, this has to be set. That's what you're saying so yeah variable name: okay,.

B

A

B

I may be wrong dependent url it it uh base64 encodes. It.

D

You know: can we just remove that uh strategies? That is suggestion. Can you try removing that uh dollar? In the beginning sure.

B

B

C

Kind of interested.

B

What this is because this doesn't look right.

D

Can you just remove the entire json response path.

D

Okay: let's something like that: okay,.

B

It doesn't code, it includes the variable name in here, so maybe we don't want the variable name.

C

Hold up on the screenshot that the um that the show on the plugins they um they do have this same live preview. So maybe that's just an internal thingy of the plugin itself, but.

D

Saying all the variables with basic shift encoding, I guess everything is saved and.

B

So so, let's, let's save this- I'm gonna just drop it somewhere else. Here for a second uh and let's clear, let's clear this, so you did send x, save variable.

B

Use a saved variable, save a value to a variable.

B

So if I send this again, is it going to be a different value, so e5 q q e5 qq? No, it's not it's the same value, so I don't know. Well I don't know, I think we tried uh I'm not sure what we would do to work through this. um I guess we can link this person to uh to the youtube.

B

Let's let me grab the link here. um Okay,.

A

A

C

Try to um try to use the variable still, okay, one.

B

Second, the.

A

Second: option: yeah: what oops? Oh man,.

A

B

Okay, what would you like to try.

C

So we're saving that variable. Let's try to do something different now: okay, on the same on the same requests, maybe on the text on the request body. Okay, try to try to to view the the the variables uh uh thingy.

B

So you can do use the saved variable and.

C

Put the name there.

A

B

Save variable my value.

C

Send now maybe ch change instead of slash headers do like um request, uh slash requests or first to see like the both the headers and the requests request.

B

B

Yeah, it's the same. Every time, though, okay.

C

Now go into the uh the post data, it says there are no variable with name my value. No variables have been set yet so we we may not be setting it right in the headers.

C

Try try, instead of um instead of putting it as a value the the thingy try as a key the thing that I think stalin mentioned so that thing you put it in the key. Instead, okay and maybe uncheck that one for now and try again.

B

Let's delete it, no variable with my value has yet been set body attribute response body attribute.

B

X, custom: um I bet you there's like console output for this. What do you think.

D

B

Nope, let's try again.

B

Cannot read properties undefined match, reading custom, okay, so yeah it did, it did have an error and it got caught. It's trying to it's trying to match. Oh look at that it disappeared. Why did that happen? So.

D

It's actually saving the weather uh so.

B

Look, they disappeared, wait what's going on.

D

What what is the json path in uh my value? What does the json path? You just said? Okay, so it's okay.

B

If you set it to.

D

Just dollar, if you set it to just dollar, you will get that.

D

And save done, okay, and if you send it.

B

D

Oh, my no, uh where, where did you use my value, can you show me that right here.

B

D

No, that is setting you will have to use uh variable, there's another function. No, that should be there. There's.

A

D

Function called variable to read the variable variable. Okay, and here you will have to give that name. So it's it's an object so because we are putting everything, it's full object. It's not json-based! It's an object right! So that's why now, if we pass yeah, if you put in that, okay done, send it once more.

B

Okay object, but but can we.

B

It still returns object, but.

C

Now it's saving something yeah.

B

It is saving something but.

D

Maybe because it's returning an array.

B

D

Value of 0.

B

I don't think there's another option like that's. That's the only way you can do it with jsonpath right. It has to return an array of matches.

B

um Oh, it doesn't return anything anymore, wait a second. What.

B

C

Because notice that error, jason's path cannot.

B

We're not doing we're doing headers, we were doing headers before that's. Why.

B

That's why that's why I wasn't returning anything? Oh and this is stuck so now, if I say headers yeah now I'll get the value out.

B

So if we look at the timeline, let's see what we sent we sent.

B

uh I don't see it x custom.

B

Am I missing something? It's not here. Oh oh, it's up here! That's why okay! So we should see that change every time it does. We should also see this variable name as a header. This is the name of the header.

D

That response path is wrong. Isn't that wrong? Is it correct name match? Okay, okay! Is that okay? Are we sending it in cusp? Okay, it's custom.

B

Yeah so and then the body yeah.

D

Wait, maybe it is working yeah, it is sending it. uh Why, don't you add some string before this variable? It's.

B

Working no, no! It's working because now look check this out see how this one ends in dot. 887. If I send again, what we're going to see is that the body had the the value.

A

B

Okay, wow, um so was this. This was required in order to do this. No.

D

uh The second one, the value is not required. uh Okay, so we are sending it in the header itself, right, okay, so that it is.

C

Yeah but notice now it's always the same, because it's only using the same value. So if you you can delete that um you can delete that variable, my value, the yeah. Okay!

C

No, no, that one you can keep, but the uh the.

A

Other one next to.

C

It's actually editing the uh the variable, so the.

D

Second time around.

A

C

You send the request is using the same value.

B

Oh okay and that's why we don't see it here in the list.

D

It's in the body, yeah yeah.

C

Notice that you won't, you only saw it like on the body after sending a second time.

B

Okay, so this is how we could do it is using this plug-in. So let's make it more correct, so csrf token.

B

um I don't can we say csrf token. Is that a okay? What is the value of that csrf token? Header? uh Xcsrf token? Oh, that's also laravel, but I don't care about laravel. Okay, it looks like xcsrf token is, is something that somebody uses. So let's just go with it. So then we want to do uh here we'll do like uuid v4 okay, so we have a uuid being generated every time, then we're going to come come in here.

B

Okay, we're going to say.

D

Instead of using okay, it's not in the body, but we can read from the header to correcting.

A

B

You can read from the header directly you're saying.

D

B

Oh okay, yeah yeah, yeah, all right, that's good! So.

C

Then you have a problem because I I don't think mark then sends that as a header.

D

Yeah I heard that.

B

That's the problem: does it yeah it does because we're using headers it should it should spit it back to us, but.

C

It does not set it.

B

As a header and send it as a.

C

Okay sends it on.

B

The request on the response, all right, then we have to do this and where's my thing that I copied okay. So then, here we're going to say, um uh csrf open.

B

And then good okay, then we need to do um csrf token. That's the value. Okay, yeah.

B

That's pretty cool someone clipped this video um yeah. That makes sense. Why that's happening! So that's how you can update a csf csrf token. So in the real world use case this, this would not be present because it would be sent by the server, um and you would actually use this header thing here, because you're grabbing a raw value of a header value of a response header um we just happen to be working with mockbin and it doesn't have- doesn't seem to have a way to spit back response headers um to echo back response.

B

Headers I mean but yeah, that's and then you would use the value here. So I just want to just just to round out the example. Let's say we were using it in json. um Like uh my thing, um we would put it like.

B

What does that stop? Okay, so we would do it like that and then yeah we would get. We would get the value out. So we see here that we sent my thing and it has the previous value so one last time it starts with nine f9. The previous token starts with knight f9. Here we go the new one that we sent starts with nine f9, so pretty cool and it's valid json okey, dokey, wow um computers, work.

A

C

We can take a short detour here and I can try to uh spread the gospel of being able to programmatically set environment variables and how that is a killer feature, because here here's the thing. uh Let me share my I think I have I I don't wanna, I'm remembering uh joe uh in the last stream saying I'm not sure if I'm authorized, because I'm gonna be using the competition, but here's the thing that I like about how they have this setup. Give me just a second, because I have a ton of windows open.

C

I lost the window where, where we have the call okay.

B

Stalin, what's the weather like for you, you said you're in india right.

D

Yeah, what's the weather, it's very rainy. It's heavy raining, it's kind of with problem, problematic rain over here.

B

um What's the temperature.

D

The temperature right now would be it's almost nine over here: nine p.m. Yeah.

D

The year is almost 25 degree celsius. It's pretty cold 25. You said yeah.

B

25., oh that's like borderline warm to me.

D

That's cold here: it's usually 30s 40s, maybe 40s yeah. You go up to 40 45 in summer and.

B

Yeah, I would not be able to. You- must have a very strong air conditioner.

D

No usually most of the houses here doesn't have it either.

B

Oh man uh well power to you. I would uh I would not last very long above 100 degrees for any length of time. I think today.

B

Weather.Com, it's 72 where I am today and it feels it's like. It feels a little a little too sunny to me a little too warm 72. I don't need right, yeah fahrenheit, so I don't. Let's let me look back at what that is. That's.

D

Two days back so the lowest it touched was uh around 14 14 15 highest. It went to almost 20 25. It was a hilly station illustration.

A

B

Well, the coldest that gets here, let's see um like the coldest it would ever get over the span of a year, would be negative 23 celsius.

B

uh But it can get definitely get into the negative 10 celsius range like that's like 5 degrees, 10 degrees, uh fahrenheit,.

D

B

It works, you know if it's too cold, you can just add more layers. You know you can just have more clothes on, but if it's, uh if it's too hot.

D

You can't do anything.

B

Yeah, I can do anything about it, so I would prefer.

B

How are you robinson where's? uh What's the weather like for you today.

A

Me, I'm okay, uh it's uh pretty bright.

C

I'm in the bay area.

B

A

B

Yeah um the uh I visited some friends in los angeles uh two years ago, and I said wow that was so nice today and they're like it's exactly like this. Every single day, every day of the year, yeah every day is a perfect day. um I guess that would get tiring after a while speaking of getting firing felipe. What's going on, you gotta, you got your demo going or what.

B

You're, muted, somehow you don't look like you're muted on the stream here, no you're up, we lost your audio. What were you gonna say, robinson, yeah,.

A

Unless there's fires going on right.

B

Yeah the fire is not so great yeah uh philippe. We can't hear you.

B

Can you do it? Can you mime it out.

A

B

um Do you wanna rejoin, or he said, he'll rejoin, okay, um yeah? I uh I have. I have uh a lot of relief that where I live, I live in michigan that we have seasons because I would not be.

B

uh I would not be so comfortable without seasons um yeah. It's.

C

B

To me that there are places where they don't have seasons so much.

C

Oh he's coming for you.

B

Oh, he come back yeah, okay, it says dimitri girl, I'll edit, your name keep going, but you can't no, they kind of can't hear us why? What happened? Where did it all.

A

B

In okay, you were gonna, you were gonna, show something I'm not sure we have. Maybe we should cut it there, I'm not sure we have time to do a whole. Another one.

B

Yeah, let's, let's, let's just leave it at that um at least we at least we got through a couple and we learned some cool stuff and uh that example, I think, is pretty valuable that we showed with how you can use a request to save values on subsequent requests without request chaining using the save variable plugin, it's pretty neat stuff, and uh there you go. We hear you hello,.

C

We can hear you now conspiracy, theorists will say, because we were about to show postman and insomnia is.

B

You share your screen. We have another, we have like four more minutes. If okay.

C

I I think it can be quick. I think I can. I can show what I want to the idea that I want to pass that I think it's an improvement that we could try and add to uh to insomnia. Hopefully you can still hear me. Let me know yep, okay, here's the thing, though, all that dancing around that we were doing in the plug-in. Can.

B

You make it a little bigger.

C

uh Yeah sure I mean the their ui is uh pretty uh cumbersome. I don't know even how I I'll try to like. I can slide this thing down. Okay,.

B

That's fine. We can't see the bottom of your screen so well, but but you can produce that collection.

D

B

D

You see with that collection if you uh yeah.

C

Holy crap anyway, it's been a while, but here's the thing that I like okay, so all that dancing around that we were doing in theory in postman. It would take a lot um very little step. So, for instance, you could in and like they have this concept that they have pre-requests and tests and whatnot so code that you can run before you run a request and code that you can run after you run a request and whatnot you don't even have to add. You know tests in here per se, but here's the thing here programmatically.

C

I can uh interact with any risk with a response, which means that here I would be able you know to go through headers and get some some um some value like the csrf uh thingy, that we were trying to do and set it up on my environment as a variable, which would mean that here I could add some if statement saying if- um and they have here snippets that I can use like get an environment variable.

C

If the uh the same variable that I set you know before the csrf thingy is set, I'm gonna append it to uh say to some to some value where I want to substitute something before I send the request, so that.

B

That wait, why wouldn't you just put it in the header like right? Why wouldn't you just write a header and put the value in there right there? You can't.

C

You can you can you can also do that. So, for instance, that that would mean that here I I can have some some sort of logic that either fetch the the environment variable or I, in this case I'm setting like a random uid and whatnot. But that's that's the thing where I think we can, where I think we can improve, because they don't force you to install, even though you know the their ui. As of now, it's even more cumbersome. It was really hard for me to find out things.

C

This is the part where I'm I'm on post, but but but you know notice that that difference, because just the fact that you can, you know attach to the logic of your request. You can start thinking about there's things that I want to do with this request. Before the request happens and also after request happens, it gives you like a whole set of new things that you can do which in insomnia, in this case, we had to use the plugin too. So.

B

You're using the test as a post request, script.

C

Yeah yeah and a ton of people use that uh we would do a lot of crazy stuff just with this kind of of idea, for instance, something that thing of I want to define a function that I want to reuse on all my requests. Okay, here's what we did at one point we convert.

C

We, we set the function somewhere as text, we converted javascript to text and we saved it an environment, valuable variable, and then we evaled that environment variable on the pre-request in order to have x or on the test in order to have access to that function, because that's also one thing that postman does really bad and in some it does have does also really bad. That is they don't allow you, as a user, you know to define your own functions.

C

Your own shared code base that you can reuse in the pre-request for the course request, stages.

B

You can't say: pm.myfunction equals.

C

I mean three years ago you couldn't, I think you, you still can't.

B

Well seems like a very obvious feature to me, um but I shouldn't talk because we don't have anything quite like that.

C

Remember folks, postman is bad.

B

Just just to say it out loud to people who don't know kong and don't know us. um Kong is an open source company, we're very prideful about that, and um I don't think there's anybody here. Who's like has ill will against anyone really, including our competitors. It's just not how we roll as a company.

B

It's not our it's, not our culture, and uh you know we just want to make great products and if other people make great products too, that's pretty good news, because then it means that we can all kind of learn from each other and move faster, we're a completely open source project. We have nothing to hide and, as you see here on the stream we're doing these things in the open, so um you know we try to try to try to live that way in the ways that we make our products.

B

I don't, I don't think, there's any problem looking at postman on an insomnia stream, it's um unless.

C

We get an invite from human resources right.

B

You don't see us on stream next week. You'll know why? Okay, just joking! um Well, thanks for coming everyone, it's been nice to hang out and uh stalin thanks for helping. uh How do can you tell me your name, because I just realized I've been saying: there's like a bee, that I've been inserting into your name, yeah.

A

People do that.

B

Sometimes it's rohington or hinton yeah, okay, I've been saying it terribly wrong. I've! Many apologies on that. um um It's now that you say it, it seems very obvious, but I had to overcomplicate it. That's all right!

B

Well, thanks for joining guys and uh we'll see you all next week.