starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #3557] [feature]: Support proxyscotch token on the interceptor menu #1220

New issue

Open

opened 2026-03-16 19:22:05 +03:00 by kerem · 6 comments

kerem commented

2026-03-16 19:22:05 +03:00

Owner

Originally created by @deeeeeelan on GitHub (Nov 16, 2023).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3557

Is there an existing issue for this?

I have searched the existing issues

Summary

As of now currently I cannot find any options on the Web UI of Hoppscotch either self-hosted one or Hoppscotch Cloud to input proxyscotch token for authorization, been getting errors.

root@server:~/proxyscotch/out/linux-server# ./proxyscotch-server-linux-amd64-v0.1.1 --host="127.0.0.1:9159" --token="XXXX"
2023/11/16 06:30:19 Starting proxy server...
2023/11/16 06:30:19 [ready=true] Listening on http://127.0.0.1:9159/
2023/11/16 06:30:24 An unauthorized request was made.
2023/11/16 06:31:48 An unauthorized request was made.

I have been looking around the docs , Discussions and Issues and I can't find any. Will be glad if you guys can implement it. Really love how can i use hoppscotch for API testing purpose rather than postman.

Why should this be worked on?

In terms of security concerns I don't think its good to leave a service unauthorised by any means. So having proxy interceptor with optional token input would be great though. It rather depends on the user they want to include the token or not.

Originally created by @deeeeeelan on GitHub (Nov 16, 2023). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3557 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Summary As of now currently I cannot find any options on the Web UI of Hoppscotch either self-hosted one or Hoppscotch Cloud to input proxyscotch token for authorization, been getting errors. ``` root@server:~/proxyscotch/out/linux-server# ./proxyscotch-server-linux-amd64-v0.1.1 --host="127.0.0.1:9159" --token="XXXX" 2023/11/16 06:30:19 Starting proxy server... 2023/11/16 06:30:19 [ready=true] Listening on http://127.0.0.1:9159/ 2023/11/16 06:30:24 An unauthorized request was made. 2023/11/16 06:31:48 An unauthorized request was made. ``` I have been looking around the docs , Discussions and Issues and I can't find any. Will be glad if you guys can implement it. Really love how can i use hoppscotch for API testing purpose rather than postman. ### Why should this be worked on? In terms of security concerns I don't think its good to leave a service unauthorised by any means. So having proxy interceptor with optional token input would be great though. It rather depends on the user they want to include the token or not.

kerem added the

feature

label

2026-03-16 19:22:05 +03:00

kerem commented

2026-03-16 19:22:16 +03:00

Author

Owner

@prathamesh-gharat commented on GitHub (Feb 28, 2025):

I tried supplying VITE_PROXYSCOTCH_ACCESS_TOKEN via .env and it did not work as expected, i.e. the accessToken in POST request payload was empty.

Using hoppscotch aio to self-host.
https://docs.hoppscotch.io/documentation/self-host/community-edition/install-and-build

I understand from another issue that the token was removed from the backend intentionally, but there if the accessToken is still going to be visible in the network log of the person making the request then it doesn't make sense to hide the option from the backend settings and move it to env. Or am I missing something? 🤔

There could be several other ways to expose the token in the current setup. In my opinion, it is best not to take up the responsibility for securing the proxy token at hoppscotch's side, that responsibility can belong to the proxy server or some MITM proxy side (Cloudflare Access). However, in case of MITM auth proxy, the handover to authentication redirect needs to be handled at hoppscotch side.

References:
https://github.com/hoppscotch/proxyscotch/issues/80

@prathamesh-gharat commented on GitHub (Feb 28, 2025): I tried supplying `VITE_PROXYSCOTCH_ACCESS_TOKEN` via .env and it did not work as expected, i.e. the `accessToken` in POST request payload was empty. Using hoppscotch aio to self-host. https://docs.hoppscotch.io/documentation/self-host/community-edition/install-and-build I understand from another issue that the token was removed from the backend intentionally, but there if the accessToken is still going to be visible in the network log of the person making the request then it doesn't make sense to hide the option from the backend settings and move it to env. Or am I missing something? 🤔 There could be several other ways to expose the token in the current setup. In my opinion, it is best not to take up the responsibility for securing the proxy token at hoppscotch's side, that responsibility can belong to the proxy server or some MITM proxy side (Cloudflare Access). However, in case of MITM auth proxy, the handover to authentication redirect needs to be handled at hoppscotch side. References: https://github.com/hoppscotch/proxyscotch/issues/80

kerem commented

2026-03-16 19:22:21 +03:00

Author

Owner

@aow-asc commented on GitHub (Apr 1, 2025):

Hi,
any news on this topic? Did I understand correctly that it is currently not possible to pass the token to the proxy? Neither via the settings page nor via the .env file?
Thanks

@aow-asc commented on GitHub (Apr 1, 2025): Hi, any news on this topic? Did I understand correctly that it is currently not possible to pass the token to the proxy? Neither via the settings page nor via the .env file? Thanks

kerem commented

2026-03-16 19:22:26 +03:00

Author

Owner

@emil-johansson-99 commented on GitHub (Apr 4, 2025):

Hi!

I have also been confused around proxy access token and environment variable VITE_PROXYSCOTCH_ACCESS_TOKEN. In POST request to proxy the accessToken attribute in payload is always empty string, even if VITE_PROXYSCOTCH_ACCESS_TOKEN is set (as prathamesh-gharat says). At least when running as docker container, if run locally with pnpm it works as expected. Reasons seems to be those to code lines:

In vite.config.ts: envPrefix: process.env.HOPP_ALLOW_RUNTIME_ENV ? "VITE_BUILDTIME_" : "VITE_"
And in prod.Dockerfile: ENV HOPP_ALLOW_RUNTIME_ENV=true

Result is that VITE_PROXYSCOTCH_ACCESS_TOKEN is never read since it does not begin with "VITE_BUILDTIME_".

But I am quite new to Hoppscotch and might have misunderstood. And what I don't understand at all is the other environment variables that starts with VITE_, do they work as expected?

Best Regards
Emil Johansson

@emil-johansson-99 commented on GitHub (Apr 4, 2025): Hi! I have also been confused around proxy access token and environment variable VITE_PROXYSCOTCH_ACCESS_TOKEN. In POST request to proxy the accessToken attribute in payload is always empty string, even if VITE_PROXYSCOTCH_ACCESS_TOKEN is set (as prathamesh-gharat says). At least when running as docker container, if run locally with pnpm it works as expected. Reasons seems to be those to code lines: 1. In vite.config.ts: envPrefix: process.env.HOPP_ALLOW_RUNTIME_ENV ? "VITE_BUILDTIME_" : "VITE_" 2. And in prod.Dockerfile: ENV HOPP_ALLOW_RUNTIME_ENV=true Result is that VITE_PROXYSCOTCH_ACCESS_TOKEN is never read since it does not begin with "VITE_BUILDTIME_". But I am quite new to Hoppscotch and might have misunderstood. And what I don't understand at all is the other environment variables that starts with VITE_, do they work as expected? Best Regards Emil Johansson

kerem commented

2026-03-16 19:22:31 +03:00

Author

Owner

@emil-johansson-99 commented on GitHub (Apr 15, 2025):

Hi again!

After checking the inner workings of Vite and environment variables I found a fix: add VITE_PROXYSCOTCH_ACCESS_TOKEN to .env.example. It can have any dummy value or just empty string as long it exists. Do you want me to create a PR?

Best Regards
Emil Johansson

@emil-johansson-99 commented on GitHub (Apr 15, 2025): Hi again! After checking the inner workings of Vite and environment variables I found a fix: add VITE_PROXYSCOTCH_ACCESS_TOKEN to .env.example. It can have any dummy value or just empty string as long it exists. Do you want me to create a PR? Best Regards Emil Johansson

kerem commented

2026-03-16 19:22:36 +03:00

Author

Owner

@Leon-Luu commented on GitHub (Apr 23, 2025):

Hello, I had done a pull request to fix this issue.

Solution:
VITE_PROXYSCOTCH_ACCESS_TOKEN must be available on the .env.example file due to this line on vite.config.ts

https://github.com/hoppscotch/hoppscotch/pull/5015

@liyasthomas please confirm

@Leon-Luu commented on GitHub (Apr 23, 2025): Hello, I had done a pull request to fix this issue. Solution: VITE_PROXYSCOTCH_ACCESS_TOKEN must be available on the .env.example file due to this line on vite.config.ts ![Image](https://github.com/user-attachments/assets/8509082e-4b52-4fcb-9408-fd4c718b97cb) https://github.com/hoppscotch/hoppscotch/pull/5015 @liyasthomas please confirm

kerem commented

2026-03-16 19:22:41 +03:00

Author

Owner

@finnmglas commented on GitHub (Jun 29, 2025):

this is still an issue

@finnmglas commented on GitHub (Jun 29, 2025): this is still an issue

kerem referenced this issue

2026-03-17 00:47:22 +03:00

[PR #1220] [MERGED] Add search input & capability to graphql types and fields #3148