thibaud-lclr/api-client
1
0
Fork 0
Code Packages Activity Actions

fix(common): improve authorization header handling (#4818)

Browse source
This commit is contained in:
Anwarul Islam 2025-03-26 17:42:41 +06:00 committed by GitHub
parent ba165bc505
commit bedb0ffdb6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 30 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
packages/hoppscotch-common/src/helpers/utils/EffectiveURL.ts
View file

@ -70,9 +70,36 @@ export const getComputedAuthHeaders = async (
showKeyIfSecret = false
) => {
const request = auth ? { auth: auth ?? { authActive: false } } : req
// If Authorization header is also being user-defined, that takes priority
if (req && req.headers.find((h) => h.key.toLowerCase() === "authorization"))
return []
/**
* Handling Authorization header priority rules:
*
* 1. If a user-defined "Authorization" header exists in the request:
* a. We generally give it priority over auth-generated headers
* b. EXCEPTION: API Key auth that uses a different header name should still be included
*
* 2. We need to check both:
* - req.auth (the current request's auth settings)
* - auth param (possibly inherited auth from a parent collection)
*
* 3. Only return empty array (blocking auth headers) when:
* - Neither req.auth nor auth param is using API Key auth, OR
* - API Key auth is being used but specifically with the "Authorization" header name
* - This prevents API Key auth from being blocked when using custom header names
*/
if (req && req.headers.find((h) => h.key.toLowerCase() === "authorization")) {
// Only return empty array if not using API key auth or if API key is using "authorization" header
if (
(!req.auth ||
req.auth.authType !== "api-key" ||
req.auth.key.toLowerCase() === "authorization") &&
(!auth ||
auth.authType !== "api-key" ||
auth.key.toLowerCase() === "authorization")
) {
return []
}
}
if (!request) return []