Secure Password Generation API Endpoint

[rashmisoni2003]

I was working on this issue: #35. I have my API ready, but when I tried testing it via Swagger UI, I encountered an authorization error. After reviewing the code, I see that JWT authentication is implemented. As far as I understand, obtaining a JWT token would require a login API. Could you please confirm if I’m on the right track, or advise the correct approach?

[DenizAltunkapan]

@rashmisoni2003 Have you tried the following approach?
You can obtain a valid JWT token by logging in through the Vault Web API. After logging in, you’ll receive a token that you can then reuse in the Password Manager service as the authorization header. This way, Swagger will accept your requests, since both services sould rely on the same authentication flow.

[rashmisoni2003]

@DenizAltunkapan
I have followed the suggestion to obtain a valid JWT token from the Vault Web service.

Here’s what I tried:

I successfully registered a user using:
POST /api/auth/register

Then I logged in using:
POST /api/auth/login

I received the JWT token and verified it through Postman — login flow works correctly
However, when I use the same token in the Password Manager backend (via Swagger UI or Postman), I still receive a 403 Forbidden response from protected endpoints.

I will attach screenshots / cURL commands of the exact requests and responses below for reference.
Register:
postman request POST 'http://localhost:8080/api/auth/register' \ --header 'Content-Type: application/json' \ --body '{ "username": "rashmi98soni@gmail.com", "password": "{{password}}" }'
Login:
postman request POST 'http://localhost:8080/api/auth/login' \ --header 'Content-Type: application/json' \ --body '{ "username": "rashmi98soni@gmail.com", "password": "{{password}}" }'
My API to test:
postman request POST 'http://localhost:8091/api/password/generate?length=18&upper=true&numbers=true&special=true' \ --header 'Authorization: Bearer {{token that i recieved from the vault-web login API}}' \ --body '' \ --auth-bearer-token '{{token}}'

Also, its a weird thing how the authentication flow for vault web work for password-manager. Anyways I would like to know if your already written APIs in password manager are working. If yes, what are the steps you follow.
Let me know if I am missing an additional configuration step, or if both services are currently expected to share a different authentication flow.

Thanks!

[DenizAltunkapan]

Hi @rashmisoni2003

the existing endpoints in Password Manager work correctly with the JWT token from Vault Web on my setup. Please make sure that your local setup is up-to-date with the main repository. You can also provide screenshots of your requests/responses to help verify the flow.

If the issue persists, please publish your code or share your branch, because I couldn’t find it. I could then clone your project and run it locally to investigate the error more thoroughly.

Thank you!

[rashmisoni2003]

@DenizAltunkapan Updating the cloned repo worked for me, thanks!