Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum will be discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Centre. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTRE DISCORD

Create new post

How to manage session refresh with JWT

apolline | Last updated: Oct 11, 2024 11:02AM UTC

Hello and nice to meet you, I'm currently working on a pentest and i'm facing some sessions issues. For the context, i have a JWT inside the "authorization" header and i want to do some scanners. Everything works fine for the first hour until the JWT expire, after that even if it gets refreshed within the browser (proxy), the burp scanner feature do not update this header. My question is, how do i update it programmaticly ? I have tried several extensions such as Stepper or the session handling rule -> check session validity. But since, the token expire after one hour, all the request after that will fallback to those extensions. Generating a new token for every single request. So i'm wondering is there a way to refresh it only once, and then store it / reuse it ? Thank you for your time

Michelle, PortSwigger Agent | Last updated: Oct 14, 2024 04:10PM UTC

Hi Have you looked into using Burp's session handling rules? If so, would you be happy to share some screenshots of the requests and responses needed to obtain a new token via email to support@portswigger.net so we can look at this in more detail with you?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.