Java HttpClient Request return 403 status while postman returns the intended response

Question

Tried to request with postman which gives desired response.

The java code used for making the same request is as below fails with a 403 status.

String url = "https://steamcommunity.com/inventory/76561198865293952/440/2?l=english&count=5000";
String cookiesString = "sessionid=" + generateSessionId() + ";steamCountry=IN%7Ce744269b3c4e531facb33ecaff29eb44";

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest
                .newBuilder()
                .GET()
                .header("User-Agent", "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36")
                .header("Accept", "*/*")
                .header("Cookie", cookiesString)
                .uri(URI.create(url))
                .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.statusCode()); //prints 403
System.out.println(response.body()); // prints       �+�� O��%   

/**
* Generates a Steam Session Id.
* @return sessionId.
*/
public static String generateSessionId() {
   return new BigInteger(96, new Random()).toString(16);
}

Postman request does not need any headers(Not even User-Agent, only Host is kept, No cookies are needed) at all to get the desired response. Even navigating to link in browser shows the json response.

PostMan request ScreenShot

Postman Request Image with cookies

Thank you. Have a great day.

Answer 1

I am pretty sure that the 2 cookies you have in postman and not in the java code are responsible for having the 403 response.

Postman is a google chrome plugin so when connecting w/ chrome, maybe you stored in the cache the cookies.

You also need to add them to the java code.

Answer 2

Firstly Thanks for all your answers and replies.

So I found that the inventory that I was trying to access was set visible to friends only, so response was 403. So it does work for inventories that are set to public.

I am sorry, I should have check it first.

What I still dont understand is how did the postman desktop client get the intended response? I understand that chrome was able to get the inventory because I have active steam login with cookies that would have been send but postman request did not have any cookies other than sessionid and country. If someone could explain how this happens it would really help me.