Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

How to manage session refresh with JWT

apolline | Last updated: Oct 11, 2024 11:02AM UTC

Hello and nice to meet you, I'm currently working on a pentest and i'm facing some sessions issues. For the context, i have a JWT inside the "authorization" header and i want to do some scanners. Everything works fine for the first hour until the JWT expire, after that even if it gets refreshed within the browser (proxy), the burp scanner feature do not update this header. My question is, how do i update it programmaticly ? I have tried several extensions such as Stepper or the session handling rule -> check session validity. But since, the token expire after one hour, all the request after that will fallback to those extensions. Generating a new token for every single request. So i'm wondering is there a way to refresh it only once, and then store it / reuse it ? Thank you for your time

Michelle, PortSwigger Agent | Last updated: Oct 14, 2024 04:10PM UTC