---
# System prepended metadata

title: Testing Partner Coupon In Prod

---

# Testing Partner Coupon In Prod

## Are you able to set jargon values as a cookie?

1. Pass in incorrect `pc` query param and make GET request to https://99designs.com.au/?pc=vulnerability

2. We assert that no `_99pc` cookie is set

## Do we redirect to the correct page with a valid token via the `/create/partner-coupons` endpoint?


1. Generated coupon

```
go run coupons.go --api-id <api-id> --api-secret <api-secret> --count 1 --aud 99designs --exp 1725206454 --nbf 1630548054 --isProd
```

2. The output should look like this:

```
{eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiI5OWRlc2lnbnMiLCJleHAiOjE3MjUyMDY0NTQsImlzcyI6Ijk5ZGVzaWducyIsImp0aSI6ImRjNTZkNDg0LWRjODAtNGM2Mi05MDNlLTc4MWQ1NWZmNDExOCIsIm5iZiI6MTYzMDU0ODA1NH0.nxcsvpL3fny5RpCRy1S8BRxwEndohVxDW-ViffpiMNU https://99designs.com/create/partner-coupons?pc=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiI5OWRlc2lnbnMiLCJleHAiOjE3MjUyMDY0NTQsImlzcyI6Ijk5ZGVzaWducyIsImp0aSI6ImRjNTZkNDg0LWRjODAtNGM2Mi05MDNlLTc4MWQ1NWZmNDExOCIsIm5iZiI6MTYzMDU0ODA1NH0.nxcsvpL3fny5RpCRy1S8BRxwEndohVxDW-ViffpiMNU}
```

3. Copy the create endpoint from the output above

4. Clear cookies and log out of 99designs.com

5. Enter create endpoint url into browser, this makes a GET request to create `/create/partner-coupons`

6. This will take the test campaign id `99designs` and redirect it to `/briefs/projects/create`  

7. The things we're expecting are:

    - It will redirect again to `/briefs/:briefId/1`

    - It will set a `_99pc` cookie with the JWT as its value


8. We confirmed that this behaviour was occurring

![](https://user-images.githubusercontent.com/23084767/131934756-82fb5b54-55ed-48ba-b67b-c414905fe513.png)