I'm writing a backend using express and node.js. I recently implemented JWT-token-generation.

That token is sent to the client after receiving the correct credentials.

This token should be saved on the client-side so it can be used for further requests, to avoid transmitting the password in every request.

Problem: I don't have a client-side yet. So I wonder, if/how I can even save this token at all?

To check my backend, my teacher gave me a list of CRUD requests for testing.

Test-request (a):

// Login with Basic Authentication as admin using correct Credentials admin:123
###
# @name loginAdminCorrect
GET http://localhost:999/authenticate
Authorization: Basic YWRtaW46MTIz

@adminToken = {{loginAdminCorrect.response.headers.Authorization}}

My server will take this request, validate it and generate a Bearer Token.

The validation and token generation would also work without this @-part and I have no this part does:

@adminToken = {{loginAdminCorrect.response.headers.Authorization}}

Next, we should only allow some requests, when a valid token is sent within the request.

Test-request (b):

### List all Users with a Token of admin
http://localhost:999/users
Authorization: {{adminToken}}

So here it looks to me that we're using a Pseudo-Token instead of the actual token, which was generated before as a result of the test request (a).

How can I test my code without the real/actual token, when my task is, to test the actual token-use-functionality?

Also, I have not seen the '@' sign in HTTP-Requests before.

So why do I even have this part and what does it do?:

@adminToken = {{loginAdminCorrect.response.headers.Authorization}}

What does this @-sign mean? And what does that whole line of code even do?

Of course, I could just write code, that will always validate when I send a token called: 'Correct_Credentials_Token'. That would not be secure at all & useless. And then I would not even use the brackets '{{content}}'.

I don't see the point, but I guess it somehow makes sense, and I just don't get it.

Thank you guys, for answering this silly question!! Google didn't like the @-sign when I asked it I guess... :-/

bonus question:

# @name loginAdminCorrect

What does this mean and is this any important?