api-client/packages/hoppscotch-selfhost-web
Shreyas 3803735d28
fix(web): add explicit headers following prior normalization (#4951)
These changes add explicit `Content-Type` headers to direct (via `native` interceptor)
authentication requests after changes made in [PR #4931](https://github.com/hoppscotch/hoppscotch/pull/4931) that modified how `Content-Type`
headers are handled in the `relay` plugin.

In [issue #4905](https://github.com/hoppscotch/hoppscotch/issues/4905), that was about Hoppscotch Agent and Native interceptor inconsistently
handling `Content-Type` headers. The issue had two main manifestations,
duplicate headers - when overriding the `Content-Type` header in the UI or using OAuth2 authentication, the agent
would send multiple `Content-Type` headers to the web server. This caused undefined behavior
and often 400 errors for backends that don't accept duplicate headers.
And inconsistent overrides - even when the content type was explicitly set (for example to
`application/json;v=2`), the agent/native would inconsistently apply this override. Server
logs revealed that roughly 50% of requests would use the correct override value, while the
others would revert to the default `application/json`.

The two-part solution implemented first in [PR #4911](https://github.com/hoppscotch/hoppscotch/pull/4911) addressed the duplicate headers issue
by implementing header normalization before final relay. This prevented duplicate headers
with different casing from being sent and [PR #4931](https://github.com/hoppscotch/hoppscotch/pull/4931) then resolved the inconsistent override
behavior by removing the automatic `Content-Type` header insertion in the `ContentHandler`
component. As explained in the PR description, this was a temporary workaround until we
implement a HTTP/2-compliant solution with proper normalization.

While the fixes in PR #4911 and #4931 correctly resolved the header inconsistency issues
for general API requests, they introduced a new problem: **requests that previously relied
on the automatic `Content-Type` insertion now have no `Content-Type` header at all**.

This mainly affects direct calls around authentication flows in the desktop module, which
were using the `content.json()` functionality without explicitly setting `Content-Type`
headers, relying on the automatic insertion that has now been removed.

These changes add the now-required explicit `Content-Type` headers to three
authentication-related API calls in the desktop platform module:

- **The initial user details GraphQL query**:
```javascript
headers: {
  Authorization: `Bearer ${accessToken}`,
  "Content-Type": "application/json",
},
```

- **The magic link email submission endpoint**:
```javascript
headers: {
  "Content-Type": "application/json",
},
```

- **The token verification endpoint**:
```javascript
headers: {
  "Content-Type": "application/json",
},
```

This will make sure that authentication flows continue to work properly with the native
interceptor after the header handling changes.

As noted in [PR #4931](https://github.com/hoppscotch/hoppscotch/pull/4931), this is considered a **temporary solution**. The plan is to revisit the
content-type handling when we implement a more comprehensive HTTP/2-compliant header
normalization system in the kernel layer.

While HTTP/1.1 headers are case-insensitive
per [RFC 7230](https://tools.ietf.org/html/rfc7230), inconsistent handling across server implementations can treat differently-cased
variations as distinct headers. HTTP/2 ([RFC 7540](https://tools.ietf.org/html/rfc7540)) mandates converting all header field
names to lowercase, which would prevent these issues altogether. In such cases, relying
fully on `MediaType` interface from the kernel will help handling these edge-cases.
2025-04-04 14:45:05 +05:30
..
src fix(web): add explicit headers following prior normalization (#4951) 2025-04-04 14:45:05 +05:30
webapp-server chore: bump version to 2025.3.0 2025-03-27 13:15:30 +05:30
.eslintrc.cjs fix: lint errors removed by using satisfies or as for type (#3934) 2024-03-28 20:28:48 +05:30
.gitignore feat: implement environments for selfhosted (#30) 2023-03-08 16:47:29 +05:30
Caddyfile fix: issues with port binding in different container runtimes (#4279) 2024-08-21 19:07:53 +05:30
Dockerfile fix: reduce the memory consumption during build to prevent OOM (#3148) 2023-07-18 00:08:06 +05:30
gql-codegen.yml chore: remove unwanted logs & use new gql generation for selfhosted-web (#65) 2023-04-04 04:18:29 +05:30
index.html feat: container registry friendly docker images and all-in-one container (#3193) 2023-08-24 00:01:28 +05:30
meta.ts fix: environment variables usage in meta tags (#3418) 2023-10-05 13:51:42 +05:30
package.json chore: bump vulnerable dependencies (#4943) 2025-03-27 22:45:29 +05:30
postcss.config.cjs fix: broken ui due to accidentally moved postcss config 2023-12-19 12:40:07 +05:30
prod_run.mjs fix(infra): deterministic env var ordering (#4893) 2025-03-19 16:08:47 +05:30
selfhost-web.Caddyfile fix: issues with port binding in different container runtimes (#4279) 2024-08-21 19:07:53 +05:30
tailwind.config.ts feat: collection runner (#3600) 2024-11-26 15:56:09 +05:30
tsconfig.json feat: platform independent core and the new desktop app (#4684) 2025-02-28 00:01:25 +05:30
tsconfig.node.json feat: selfhost auth frontend (#15) 2023-02-09 01:12:44 +05:30
vite.config.ts fix: prevent dev server crashes due to breaking changes in the vue-i18n suite of tools 2025-03-18 12:29:18 +05:30