I'm testing (in Postman) a basic username/password flow. I have created Managed App in Salesforce so I have all that I need to invoke token endpoint and get an access token:

The first call to the token endpoint

So far so good. The process will return me an access_token and some infos about it. As far as I know the id URL should be used to

  • get extra info about user,
  • identify the user,

So I invoke the identity URL for the first time and I get (as I suppose) missingOAuthToken. Then I set Authorization header with value Bearer <access_token>, and now it works.

The strange things happen now: if I modify the access token, putting randomly char, altering the cahracters lenght when I send the request I'm still authorized. Why this happens? This would be too strange, and since I'm not into Salesforce, I'm probably missing something.

  • Are you sure that the modified value is passed to salesforce? Can you try to extract some data with this access token? – AtulRajguru9 Jul 12 '17 at 10:00
  • Absolutely. Furthermore Postman automatically sends no-cache header – BAD_SEED Jul 12 '17 at 10:01
  • I have always had a problem using Postman, try www.onlinecurl.com or www.hurl.it and see if you have the same issue? Also, could you please try the same thing while making a request via salesforce itself? It might not work in some other cases. – Mohit Arora Jul 13 '17 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.