# Removign Origin from request **URL:** \ **Category:** Gatling (Open-Source)\ **Created:** [May 26, 2021, 1:44pm UTC](https://community.gatling.io/t/removign-origin-from-request/6124 "2021-05-26T13:44:22Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Technical\_Nissshh](https://avatars.discourse-cdn.com/v4/letter/t/f04885/32.png) [@Technical\_Nissshh](https://community.gatling.io/u/Technical_Nissshh)\ **Post date:** [May 26, 2021, 1:44pm UTC](https://community.gatling.io/t/removign-origin-from-request/6124/1 "2021-05-26T13:44:22Z")
Hi I am using Gatling Maven Plugin and trying to generate an okta access token I am able to do teh steps untill it fetchs the okta token where I get this error HTTP response: status: 401 Unauthorized body: {“error”:“invalid\_client”,“error\_description”:“Browser requests to the token endpoint must use Proof Key for Code Exchange.”} I referred the article at [https://support.okta.com/help/s/article/Browser-requests-to-the-token-endpoint-must-use-Proof-Key-for-Code-Exchange?language=en\_US](https://support.okta.com/help/s/article/Browser-requests-to-the-token-endpoint-must-use-Proof-Key-for-Code-Exchange?language=en_US) Which says that I should remove Origin from the request. **Can anyone help how I can remove the header from the request?** HTTP request: POST [https://sso.xyz.com/oauth2/ausi42oq1q3k7OuZJ0h7/v1/token](https://sso.xyz.com/oauth2/ausi42oq1q3k7OuZJ0h7/v1/token) headers: referer: [https://sso.xyz.com/oauth2/ausi42oq1q3k7OuZJ0h7/v1/authorize?client\_id=0oaicbuf41sc34Kc00h7&sessionToken=20111zF\_55aNDScQFvuV8ko3Wodtk7xc9I6Zhumq0LZV6-R-uVTJuPh&redirect\_uri=https://XXXXXXX/&response\_type=code&response\_mode=form\_post&state=test&nonce=YwNaWtnKXjOnlGa5ipKCD81ye4l8zYQL&prompt=none&scope=openid+profile](https://sso.xyz.com/oauth2/ausi42oq1q3k7OuZJ0h7/v1/authorize?client_id=0oaicbuf41sc34Kc00h7&sessionToken=20111zF_55aNDScQFvuV8ko3Wodtk7xc9I6Zhumq0LZV6-R-uVTJuPh&redirect_uri=https://XXXXXXX/&response_type=code&response_mode=form_post&state=test&nonce=YwNaWtnKXjOnlGa5ipKCD81ye4l8zYQL&prompt=none&scope=openid+profile) accept: _/_ origin: [https://sso](https://sso) .xyz.johndeere.com host: [sso-qual.johndeere.com](http://sso-qual.johndeere.com) content-type: application/x-www-form-urlencoded content-length: 229 ---
**Author:** ![slandelle](https://dub1.discourse-cdn.com/flex013/user_avatar/community.gatling.io/slandelle/32/4_2.png) [@slandelle](https://community.gatling.io/u/slandelle)\ **Post date:** [May 26, 2021, 3:08pm UTC](https://community.gatling.io/t/removign-origin-from-request/6124/2 "2021-05-26T15:08:07Z")
Currently, origin header is automatically added as soon as we have a referer header and the request is neither GET nor HEAD. We could introduce an option to disable this in a future version. In the meantime, you can try setting disableAutoReferer on the HttpProtocol. ---
**Author:** ![slandelle](https://dub1.discourse-cdn.com/flex013/user_avatar/community.gatling.io/slandelle/32/4_2.png) [@slandelle](https://community.gatling.io/u/slandelle)\ **Post date:** [May 26, 2021, 3:10pm UTC](https://community.gatling.io/t/removign-origin-from-request/6124/3 "2021-05-26T15:10:23Z")
Feel free to contribute, this is a pretty low hanging fruit: [https://github.com/gatling/gatling/issues/4099](https://github.com/gatling/gatling/issues/4099) ---
**Author:** ![Technical\_Nissshh](https://avatars.discourse-cdn.com/v4/letter/t/f04885/32.png) [@Technical\_Nissshh](https://community.gatling.io/u/Technical_Nissshh)\ **Post date:** [May 31, 2021, 10:52am UTC](https://community.gatling.io/t/removign-origin-from-request/6124/4 "2021-05-31T10:52:33Z")
Hi Stephane I read this late, and could see you added the fix. This is going to happen at a global level, but better would be to provide an option to remove a specific header . Will give more power to the end. user. What do you think? Now the problem is that for some I cannot work with as the referrer is removed. Thanks Nishant ---
**Author:** ![Technical\_Nissshh](https://avatars.discourse-cdn.com/v4/letter/t/f04885/32.png) [@Technical\_Nissshh](https://community.gatling.io/u/Technical_Nissshh)\ **Post date:** [May 31, 2021, 10:53am UTC](https://community.gatling.io/t/removign-origin-from-request/6124/5 "2021-05-31T10:53:20Z")
In the meantime, you can try setting disableAutoReferer on the HttpProtocol , this option has other repercussion on the useage. ---
**Author:** ![Technical\_Nissshh](https://avatars.discourse-cdn.com/v4/letter/t/f04885/32.png) [@Technical\_Nissshh](https://community.gatling.io/u/Technical_Nissshh)\ **Post date:** [May 31, 2021, 11:00am UTC](https://community.gatling.io/t/removign-origin-from-request/6124/6 "2021-05-31T11:00:48Z")
I have below snippet .exec(http(“Get Token”) .post(“[https://xyz.com/oauth2/](https://xyz.com/oauth2/)/v1/token”) .headers(constants.OktaFormHeaders) .formParam(“grant\_type”, “authorization\_code”) .formParam(“code”, “${code}”) .formParam(“redirect\_uri”, “[https://xyz.com/](https://xyz.com/)”) .formParam(“client\_id”, “”) .formParam(“client\_secret”, " “) .check(jsonPath(”$…access\_token").saveAs(“access\_token”))) I am thinkging if below can be added .exec(http(“Get Token”) .post(“[https://xyz.com/oauth2/](https://xyz.com/oauth2/)/v1/token”) .headers(constants.OktaFormHeaders) .remove(constants.OriginHeader) .formParam(“grant\_type”, “authorization\_code”) .formParam(“code”, “${code}”) .formParam(“redirect\_uri”, “[https://xyz.com/](https://xyz.com/)”) .formParam(“client\_id”, “”) .formParam(“client\_secret”, " “) .check(jsonPath(”$…access\_token").saveAs(“access\_token”))) Not sure this can be done.