Tutorials / Authentication

Locating Authorization Tokens in Microsoft Edge

🔐 Module – Locating Authorization Tokens in Microsoft Edge (DevTools Guide)

This guide empowers users to extract HTTP Authorization tokens issued by web applications—such as bearer JWTs or session cookies—using Microsoft Edge Developer Tools. These steps help you verify token flows, debug authentication, and configure PAC manifests for authenticated testing.

  • * *

🛠️ Step 1: Open Edge Developer Tools

  • Launch Microsoft Edge and navigate to your application—the one where an authenticated session is active.
  • Open DevTools by pressing F12, or right-click on the page and select Inspect.

You should now see panels like Elements, Console, Network, etc.

  • * *

🔍 Step 2: Start Capturing Network Traffic

1. Click the Network tab in the DevTools pane.

2. Ensure the Record button is active (it appears red by default).

3. If you need continuity across page navigations, enable “Preserve log” from the toolbar.

4. Perform an action that initiates authentication or API calls (e.g., log in, refresh data).

  • * *

⚙️ Step 3: Locate the Authorization Header

1. Use built-in filters to narrow down requests:

  • Set the filter to XHR or Fetch to view only API calls.

2. Identify a request associated with protected endpoints (often returning 200 OK).

  • Alternatively, type keywords like auth, token, or login in the filter box.

3. Click the row to view Request details in the right-hand pane.

4. Select the Headers tab to inspect HTTP headers.

5. Look under Request Headers for the Authorization field. You may see:

  • Authorization: Bearer <token>
  • Or other schemes like Basic or custom values.
  • * *

🧾 Step 4: Decode a JWT Token (if applicable)

If the token appears to be a JSON Web Token (base64 segments separated by periods), Edge DevTools lets you inspect its parts:

1. Copy the token value from the Authorization header (omit the Bearer prefix).

2. Go to the Console tab and type:

const parts = '<token>'.split('.'); const payload = parts[1]; console.log(JSON.parse(atob(payload)));

Replace <token> with the actual string.

3. This outputs the decoded JWT payload, revealing claims like sub, roles, exp, etc.

  • * *

📦 Step 5: Retrieve Tokens from Application Storage

In some scenarios, tokens aren't sent as headers but managed in browser storage—for example, in SPAs. To extract them:

1. Switch to the Application tab within DevTools.

2. Under Storage, check:

  • Local Storage (look for keys like accessToken, id_token, etc.)
  • Session Storage

3. Click Console, then execute:

  • Or Cookies, especially for session-based authentication.

console.log(localStorage.getItem('accessToken')); console.log(document.cookie);

Replace 'accessToken' with the actual key your app uses.

  • * *

❗ Important Escalation Note

Keep in mind: Authorization headers are visible to anyone with access to the browser. Do not rely on client-side obfuscation for hiding secrets. Instead, consider moving token exchange logic to a trusted backend service and proxying requests from the browser—this is standard best practice.

  • * *

📝 Usage Tips & Best Practices

| Tip | Description |

| ✅ Preserve log | Always activate when navigating between pages or during multi-step flows. |

| 🔎 Use Filters | Apply XHR/Fetch or keywords like auth to quickly find relevant requests. |

| 🔐 Handle with care | Tokens are sensitive. Avoid exposing or hardcoding them—use Prancer Vault or secure test credentials. |

| 🆔 Audit JWTs | Inspect encoded claims for roles, expiry (exp), audience (aud), etc. |

| 🌍 Test in Incognito | Helps simulate a clean user session and avoid browser caching artifacts. |

  • * *