Authenticated REST Communication via Postman

1 – What you are building

SICK LiDAR sensors expose a JSON REST API over plain HTTP. Reading a value (GET) needs no authentication. Writing a value or running a method (POST) requires Challenge-Response authentication: the device hands out a one-time puzzle, and the client answers with a SHA-256 hash chain that proves it knows the password, without ever sending the password.

Doing that by hand for every request is tedious. This guide sets up Postman so it happens automatically: you paste a small script once at the collection level, and every protected POST is authenticated for you.

What you need

2 – Install and open Postman

3 – Import the OpenAPI file to get a collection

Postman can turn the device’s openapi.yaml into a ready-made collection: a folder of pre-built requests for every endpoint, so you do not have to type URLs by hand.

4 – Create the environment and enter your password

An environment is a named set of variables (device IP, user, password). Keeping them here means you never hard-code them into requests and can switch between devices easily.

5 – Paste the pre-request script at collection level

A pre-request script runs automatically before a request is sent. Placed at the collection level, it applies to every request in that collection, so all protected POSTs get authenticated with one setup.

6 – Send your first authenticated write

Let’s change LocationName. Writing a parameter needs Challenge-Response only. The script handles it.

{
  "data": { "LocationName": "my-sensor" }
}

POST http://192.168.0.1/api/getChallenge     200
POST http://192.168.0.1/api/LocationName      200

7 – What the script does under the hood

For any write request (POST/PUT/PATCH/DELETE) the script fetches a fresh challenge, computes the SHA-256 hash chain, and rewrites the JSON body so the proof travels in the "header" field alongside your "data". GET requests are left untouched.

Postman (pre-request script)                      Sensor
  |                                                |
  |  POST {{baseUrl}}/getChallenge                 |
  |  { "data": { "user": "Service" } }             |
  |──────────────────────────────────────────────►|
  |  { "challenge": { nonce, opaque, realm, salt }}|
  |◄──────────────────────────────────────────────|
  |                                                |
  |  hash1 = SHA256(user:realm:password[:salt])    |
  |  hash2 = SHA256("POST:" + endpointName)        |
  |  response = SHA256(hash1:nonce:hash2)           |
  |                                                |
  |  POST {{baseUrl}}/<endpoint>                    |
  |  { "header": { nonce, opaque, realm,           |
  |                response, user },               |
  |    "data":   { ... } }                         |
  |──────────────────────────────────────────────►|
  |  { "header": { "status": 0, "message": "Ok" }} |
  |◄──────────────────────────────────────────────|

8 – Collection-level pre-request script

Copy this entire block into Collection name → Scripts → Pre-request Script. It is self-contained and uses only Postman’s built-in CryptoJS.

/* =============================================================================
 * Challenge-Response Authentication
 * Postman collection-level Pre-request Script
 * (Collection name -> Scripts -> Pre-request Script)
 *
 * DEMONSTRATION USE ONLY
 *   This script is provided for demonstration and evaluation purposes only.
 *   It is not hardened for production use. Review, test, and adapt it to your
 *   own security requirements before using it in a productive environment.
 *
 * Behavior:
 *   For write requests (POST/PUT/PATCH/DELETE) it fetches a challenge from the
 *   device, computes the response hash, and embeds an auth `header` object into
 *   the JSON request body:
 *       { "header": { nonce, opaque, realm, response, user }, "data": { ... } }
 *
 * Environment variables:
 *   baseUrl              scheme + host, e.g. http://192.168.0.1 (no trailing /)
 *   user                 e.g. Service
 *   password             device password (keep as a secret; never commit)
 *   enableAuthentication "true" / "false"
 *   challengePath        (optional) challenge endpoint path override
 *                        (auto-derived from the URL style if unset)
 * ========================================================================== */

(function () {
    'use strict';

    function isTrue(value) {
        if (value === null || value === undefined || value === '') return false;
        try { return JSON.parse(String(value).toLowerCase()) === true; }
        catch (e) { return String(value).toLowerCase() === 'true'; }
    }

    // Convert an array of byte values (0..255) into a CryptoJS WordArray.
    function bytesToWordArray(bytes) {
        var words = [];
        for (var i = 0; i < bytes.length; i++) {
            words[i >>> 2] |= (bytes[i] & 0xff) << (24 - (i % 4) * 8);
        }
        return CryptoJS.lib.WordArray.create(words, bytes.length);
    }

    // Pure algorithm: returns the auth `header` object for the request body.
    function calculateAuthHeader(user, password, challenge, method, path) {
        var ha1;
        if (challenge.salt == null) {
            ha1 = CryptoJS.SHA256(user + ':' + challenge.realm + ':' + password).toString();
        } else {
            var prefix = CryptoJS.enc.Latin1.parse(user + ':' + challenge.realm + ':' + password + ':');
            ha1 = CryptoJS.SHA256(prefix.concat(bytesToWordArray(challenge.salt))).toString();
        }
        var ha2 = CryptoJS.SHA256(method + ':' + path).toString();
        return {
            nonce: challenge.nonce,
            opaque: challenge.opaque,
            realm: challenge.realm,
            response: CryptoJS.SHA256(ha1 + ':' + challenge.nonce + ':' + ha2).toString(),
            user: user
        };
    }

    // --- Guard clauses -------------------------------------------------------
    var method = pm.request.method ? pm.request.method.toUpperCase() : 'GET';
    var fullUrl = pm.variables.replaceIn(pm.request.url.toString());

    if (fullUrl.indexOf('/crown') > -1) return;
    if (['POST', 'PUT', 'PATCH', 'DELETE'].indexOf(method) === -1) return;
    if (fullUrl.indexOf('getChallenge') > -1) return;
    if (!isTrue(pm.environment.get('enableAuthentication'))) return;

    // --- Required variables --------------------------------------------------
    var baseUrl = pm.environment.get('baseUrl');
    var user = pm.environment.get('user');
    var password = pm.environment.get('password');

    if (!baseUrl) throw new Error('[AUTH] Missing environment variable "baseUrl".');
    if (!user) throw new Error('[AUTH] Missing environment variable "user".');
    if (password === null || password === undefined || password === '') {
        throw new Error('[AUTH] Missing environment variable "password".');
    }
    baseUrl = String(baseUrl).replace(/\/+$/, '');

    // --- Derive variable name + challenge URL --------------------------------
    // Variable name = URL path after host, with a leading "api/" removed if present,
    // so both {{baseUrl}}/api/Name and {{baseUrl}}/Name yield the same name.
    var afterScheme = fullUrl.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, '');
    var firstSlash = afterScheme.indexOf('/');
    var pathPart = (firstSlash === -1 ? '' : afterScheme.substring(firstSlash + 1))
        .split('?')[0].split('#')[0].replace(/\/+$/, '');

    var hadApiPrefix = false;
    if (pathPart.indexOf('api/') === 0) { pathPart = pathPart.substring(4); hadApiPrefix = true; }
    var variableName = pathPart.trim();
    if (!variableName) throw new Error('[AUTH] Could not determine variable name from URL: ' + fullUrl);

    var challengePath = pm.environment.get('challengePath');
    if (!challengePath) challengePath = hadApiPrefix ? '/api/getChallenge' : '/getChallenge';
    if (challengePath.charAt(0) !== '/') challengePath = '/' + challengePath;
    var challengeUrl = baseUrl + challengePath;

    // --- Read + resolve the current request body (raw JSON) ------------------
    var rawBody = pm.variables.replaceIn((pm.request.body && pm.request.body.raw) ? pm.request.body.raw : '{}');
    var bodyContent;
    try { bodyContent = JSON.parse(rawBody); }
    catch (e) { throw new Error('[AUTH] Request body is not valid JSON: ' + rawBody); }

    // --- Fetch challenge, compute header, rewrite body -----------------------
    pm.sendRequest({
        url: challengeUrl,
        method: 'POST',
        header: { 'Content-Type': 'application/octet-stream' },
        body: { mode: 'raw', raw: JSON.stringify({ data: { user: user } }) }
    }, function (err, res) {
        if (err) throw new Error('[AUTH] Challenge request failed: ' + err);
        if (!res || res.code !== 200) {
            throw new Error('[AUTH] Challenge request returned HTTP ' + (res ? res.code : 'no response'));
        }

        var challenge;
        try { challenge = res.json().challenge; }
        catch (e) { throw new Error('[AUTH] Challenge response is not valid JSON.'); }
        if (!challenge || !challenge.realm || !challenge.nonce) {
            throw new Error('[AUTH] Unexpected challenge response format: ' + JSON.stringify(challenge));
        }

        var header;
        try { header = calculateAuthHeader(user, password, challenge, method, variableName); }
        catch (e) { throw new Error('[AUTH] Hash calculation failed: ' + e.message); }

        pm.request.body.update({
            mode: 'raw',
            raw: JSON.stringify({ header: header, data: bodyContent.data }),
            options: { raw: { language: 'json' } }
        });
        pm.request.headers.upsert({ key: 'Content-Type', value: 'application/json' });
    });
})();

9 – Troubleshooting