[GH-ISSUE #3572] [bug]: Allow Client Secret for OAuth2 Authentication #1225

New issue

Closed

opened 2026-03-16 19:23:38 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 19:23:38 +03:00

Owner

Originally created by @Dan6erbond on GitHub (Nov 21, 2023).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3572

Is there an existing issue for this?

I have searched the existing issues

Current behavior

Previously Hoppscotch would allow setting no client secret for OAuth2 authentication, which would then trigger the client credentials flow for providers such as Azure AD.

The recent 2023.8.4 release adds validation for the clientSecret that forces users to set it, which will trigger the authorization code flow.

However, authorization code cannot be used, because Hoppscotch's final token exchange happens on the client, where Azure AD has CORS headers that block the request as well as a check on the Origin header, throwing the following error with a 400 Bad Request:

AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://hoppscotch.io'.

Steps to reproduce

Create a request to an authorized API with OAuth2.
Set authorization type to "OAuth 2.0".
Configure the authorization code flow by setting client secret / client credentials flow by removing it.
Click "Generate Token".

Environment

Production

Version

Cloud

Originally created by @Dan6erbond on GitHub (Nov 21, 2023). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3572 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior Previously Hoppscotch would allow setting no client secret for OAuth2 authentication, which would then trigger the client credentials flow for providers such as Azure AD. The recent 2023.8.4 release adds [validation for the `clientSecret`](https://github.com/hoppscotch/hoppscotch/pull/3531/files#diff-38391f555a8116c520a32b72d05b184e3351b1c25ba61436e568b6a97d6812ceR264) that forces users to set it, which will trigger the authorization code flow. However, authorization code cannot be used, because Hoppscotch's final token exchange happens on the client, where Azure AD has CORS headers that block the request as well as a check on the `Origin` header, throwing the following error with a 400 Bad Request: > AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://hoppscotch.io'. ### Steps to reproduce 1. Create a request to an authorized API with OAuth2. 2. Set authorization type to "OAuth 2.0". 3. Configure the authorization code flow by setting client secret / client credentials flow by removing it. 4. Click "Generate Token". ### Environment Production ### Version Cloud