Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

JWT Support for Session Handling

Jordan | Last updated: Mar 18, 2020 01:51PM UTC

Creating session handling rules for applications that utilize JWT's for authentication poses an interesting problem since as far as I can tell, using a Macro and Session Handling rules only allows the ability to update cookies. The ability to add the received Cookies as Headers instead would alleviate the issue and allow us to automatically update JWT values. I have also seen where XSRF tokens are assigned like cookies, but placed in the Request as a Header.

Liam, PortSwigger Agent | Last updated: Mar 18, 2020 02:20PM UTC