api-client/packages
Shreyas 3803735d28
fix(web): add explicit headers following prior normalization (#4951)
These changes add explicit `Content-Type` headers to direct (via `native` interceptor)
authentication requests after changes made in [PR #4931](https://github.com/hoppscotch/hoppscotch/pull/4931) that modified how `Content-Type`
headers are handled in the `relay` plugin.

In [issue #4905](https://github.com/hoppscotch/hoppscotch/issues/4905), that was about Hoppscotch Agent and Native interceptor inconsistently
handling `Content-Type` headers. The issue had two main manifestations,
duplicate headers - when overriding the `Content-Type` header in the UI or using OAuth2 authentication, the agent
would send multiple `Content-Type` headers to the web server. This caused undefined behavior
and often 400 errors for backends that don't accept duplicate headers.
And inconsistent overrides - even when the content type was explicitly set (for example to
`application/json;v=2`), the agent/native would inconsistently apply this override. Server
logs revealed that roughly 50% of requests would use the correct override value, while the
others would revert to the default `application/json`.

The two-part solution implemented first in [PR #4911](https://github.com/hoppscotch/hoppscotch/pull/4911) addressed the duplicate headers issue
by implementing header normalization before final relay. This prevented duplicate headers
with different casing from being sent and [PR #4931](https://github.com/hoppscotch/hoppscotch/pull/4931) then resolved the inconsistent override
behavior by removing the automatic `Content-Type` header insertion in the `ContentHandler`
component. As explained in the PR description, this was a temporary workaround until we
implement a HTTP/2-compliant solution with proper normalization.

While the fixes in PR #4911 and #4931 correctly resolved the header inconsistency issues
for general API requests, they introduced a new problem: **requests that previously relied
on the automatic `Content-Type` insertion now have no `Content-Type` header at all**.

This mainly affects direct calls around authentication flows in the desktop module, which
were using the `content.json()` functionality without explicitly setting `Content-Type`
headers, relying on the automatic insertion that has now been removed.

These changes add the now-required explicit `Content-Type` headers to three
authentication-related API calls in the desktop platform module:

- **The initial user details GraphQL query**:
```javascript
headers: {
  Authorization: `Bearer ${accessToken}`,
  "Content-Type": "application/json",
},
```

- **The magic link email submission endpoint**:
```javascript
headers: {
  "Content-Type": "application/json",
},
```

- **The token verification endpoint**:
```javascript
headers: {
  "Content-Type": "application/json",
},
```

This will make sure that authentication flows continue to work properly with the native
interceptor after the header handling changes.

As noted in [PR #4931](https://github.com/hoppscotch/hoppscotch/pull/4931), this is considered a **temporary solution**. The plan is to revisit the
content-type handling when we implement a more comprehensive HTTP/2-compliant header
normalization system in the kernel layer.

While HTTP/1.1 headers are case-insensitive
per [RFC 7230](https://tools.ietf.org/html/rfc7230), inconsistent handling across server implementations can treat differently-cased
variations as distinct headers. HTTP/2 ([RFC 7540](https://tools.ietf.org/html/rfc7540)) mandates converting all header field
names to lowercase, which would prevent these issues altogether. In such cases, relying
fully on `MediaType` interface from the kernel will help handling these edge-cases.
2025-04-04 14:45:05 +05:30
..
codemirror-lang-graphql feat: platform independent core and the new desktop app (#4684) 2025-02-28 00:01:25 +05:30
hoppscotch-agent chore: bump vulnerable dependencies (#4943) 2025-03-27 22:45:29 +05:30
hoppscotch-backend chore: bump version to 2025.3.0 2025-03-27 13:15:30 +05:30
hoppscotch-cli chore: bump vulnerable dependencies (#4943) 2025-03-27 22:45:29 +05:30
hoppscotch-common fix: import bug with extension and agent interceptors (#4932) 2025-03-28 17:52:45 +05:30
hoppscotch-data fix: resolve typos across packages (#4867) 2025-03-12 13:53:08 +05:30
hoppscotch-desktop chore: bump version to 2025.3.0 2025-03-27 13:15:30 +05:30
hoppscotch-js-sandbox feat: add support for Digest authorization (#4339) 2024-10-29 12:34:40 +05:30
hoppscotch-kernel chore: bump vulnerable dependencies (#4943) 2025-03-27 22:45:29 +05:30
hoppscotch-relay feat: platform independent core and the new desktop app (#4684) 2025-02-28 00:01:25 +05:30
hoppscotch-selfhost-desktop chore: bump vulnerable dependencies (#4943) 2025-03-27 22:45:29 +05:30
hoppscotch-selfhost-web fix(web): add explicit headers following prior normalization (#4951) 2025-04-04 14:45:05 +05:30
hoppscotch-sh-admin chore: bump vulnerable dependencies (#4943) 2025-03-27 22:45:29 +05:30