starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-26 01:06:00 +03:00

[GH-ISSUE #3784] [bug]: OAuth 2.0 implementation does not support authorization code flow with PKCE #1319

New issue

Closed

opened 2026-03-16 19:48:48 +03:00 by kerem · 8 comments

kerem commented

2026-03-16 19:48:48 +03:00

Owner

Originally created by @cmaune on GitHub (Jan 29, 2024).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3784

Is there an existing issue for this?

I have searched the existing issues

Current behavior

As mentioned in the readme.md OIDC Access Token/PKCE should be supported.

Currently after filling up all necessary fields for OAuth 2.0 (OpenId Connect Discorvery URL, Authorization URL, Access Token URL, Client Id and Scope) a token request with "client_secret: undefinied" is send to the configured token endpoint.
But for PKCE the clientSecret is not needed.

This leads at least with Azure as an identity plaform to an error.

Further more the input validation only seems to kick off after a "browser" refresh.
When creating a new request and filling up all necessary fields for PKCE the request is send, after a browser refresh clicking the button "Generate token" leads to a warning "No client secret defined"

Possible Fix:

Remove the required check for client_secret: https://github.com/hoppscotch/hoppscotch/blob/main/packages/hoppscotch-common/src/helpers/oauth.ts#L263-L265
Only pass client_secret as parameter when its set ( != undefined, empty, etc.): https://github.com/hoppscotch/hoppscotch/blob/main/packages/hoppscotch-common/src/helpers/oauth.ts#L278

Steps to reproduce

Go to "REST" Tab
Click an "Authorization" for any Request
Fill up OpenID Connect Discovery URL, Authorization URL, Access Token URL, Client Id and Scope
Press "Generate Token"
Look at the request made in dev-tools, this includes a client_secret=undefined.

Environment

Production

Version

Cloud

Originally created by @cmaune on GitHub (Jan 29, 2024). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3784 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior As mentioned in the readme.md OIDC Access Token/PKCE should be supported. Currently after filling up all necessary fields for OAuth 2.0 (OpenId Connect Discorvery URL, Authorization URL, Access Token URL, Client Id and Scope) a token request with "client_secret: undefinied" is send to the configured token endpoint. But for PKCE the clientSecret is **not needed**. This leads at least with Azure as an identity plaform to an error. Further more the input validation only seems to kick off after a "browser" refresh. When creating a new request and filling up all necessary fields for PKCE the request is send, after a browser refresh clicking the button "Generate token" leads to a warning "No client secret defined" Possible Fix: - Remove the required check for client_secret: https://github.com/hoppscotch/hoppscotch/blob/main/packages/hoppscotch-common/src/helpers/oauth.ts#L263-L265 - Only pass client_secret as parameter when its set ( != undefined, empty, etc.): https://github.com/hoppscotch/hoppscotch/blob/main/packages/hoppscotch-common/src/helpers/oauth.ts#L278 ### Steps to reproduce 1. Go to "REST" Tab 2. Click an "Authorization" for any Request 3. Fill up OpenID Connect Discovery URL, Authorization URL, Access Token URL, Client Id and Scope 4. Press "Generate Token" 5. Look at the request made in dev-tools, this includes a client_secret=undefined. ### Environment Production ### Version Cloud

kerem

2026-03-16 19:48:48 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 19:49:03 +03:00

Author

Owner

@tonnico commented on GitHub (Feb 13, 2024):

Is there a workaround until the problem is fixed?

@tonnico commented on GitHub (Feb 13, 2024): Is there a workaround until the problem is fixed?

kerem commented

2026-03-16 19:49:09 +03:00

Author

Owner

@aconstantin commented on GitHub (Feb 13, 2024):

Do you need any help here? Should we try to provide a fix? If yes, can you provide some guidance?

@aconstantin commented on GitHub (Feb 13, 2024): Do you need any help here? Should we try to provide a fix? If yes, can you provide some guidance?

kerem commented

2026-03-16 19:49:14 +03:00

Author

Owner

@MarcelHoell commented on GitHub (Feb 29, 2024):

That fix would be pretty nice!

@MarcelHoell commented on GitHub (Feb 29, 2024): That fix would be pretty nice!

kerem commented

2026-03-16 19:49:19 +03:00

Author

Owner

@StormicK commented on GitHub (Apr 18, 2024):

Are there any news about this topic?

@StormicK commented on GitHub (Apr 18, 2024): Are there any news about this topic?

kerem commented

2026-03-16 19:49:24 +03:00

Author

Owner

@mkohns commented on GitHub (Apr 28, 2024):

Hi. I would like to follow up on this:

I am using Desktop App Version: Version 24.3.1-2 (20240423.091309)

When configuring "Authorization" Tab for a REST call to use OAuth2 with PKCE the "client_secret" seems to be mandatory. If you do not provide it - hoppscotch shows a toast message with validation error.

From my point of view the OAuth2 with PKCE for so called public clients should not have a secret provided.
This is due to the fact as the secret can not be stored securely in SPAs, Mobile Apps or Desktop Apps which does not have a backend for authentication.

If you try to provide an client secret - the Azure AD (now EntraID) also identifies this and responses an error:

{"error":"invalid_client","error_description":"AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented}.

From my perspective the code change could look like this:

make client_secret optional if PKCE is enabled:
github.com/hoppscotch/hoppscotch@844eee0fa4/packages/hoppscotch-common/src/services/oauth/flows/authCode.ts (L33)
only append client_secret if also provided by user:
github.com/hoppscotch/hoppscotch@844eee0fa4/packages/hoppscotch-common/src/services/oauth/flows/authCode.ts (L206)

The rest looks great to me.

@amk-dev and @jamesgeorge007 seemed to implemented this great feature.
Could you please comment here?

@mkohns commented on GitHub (Apr 28, 2024): Hi. I would like to follow up on this: I am using Desktop App Version: Version 24.3.1-2 (20240423.091309) When configuring "Authorization" Tab for a REST call to use OAuth2 with PKCE the "client_secret" seems to be mandatory. If you do not provide it - hoppscotch shows a toast message with validation error. From my point of view the OAuth2 with PKCE for so called public clients should not have a secret provided. This is due to the fact as the secret can not be stored securely in SPAs, Mobile Apps or Desktop Apps which does not have a backend for authentication. If you try to provide an client secret - the Azure AD (now EntraID) also identifies this and responses an error: `{"error":"invalid_client","error_description":"AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented}.` From my perspective the code change could look like this: 1. make client_secret optional if PKCE is enabled: https://github.com/hoppscotch/hoppscotch/blob/844eee0fa4c0a5187a046f6b8c2c3fc3ed4ab4b6/packages/hoppscotch-common/src/services/oauth/flows/authCode.ts#L33 2. only append client_secret if also provided by user: https://github.com/hoppscotch/hoppscotch/blob/844eee0fa4c0a5187a046f6b8c2c3fc3ed4ab4b6/packages/hoppscotch-common/src/services/oauth/flows/authCode.ts#L206 The rest looks great to me. @amk-dev and @jamesgeorge007 seemed to implemented this great feature. Could you please comment here?

kerem commented

2026-03-16 19:49:29 +03:00

Author

Owner

@mkohns commented on GitHub (Apr 28, 2024):

I have set up the local dev environment for the hoppscotch desktop application and just uncommented the above lines for testing. I can confirm that the auth flow is then working as expected. Nice.

@mkohns commented on GitHub (Apr 28, 2024): I have set up the local dev environment for the hoppscotch desktop application and just uncommented the above lines for testing. I can confirm that the auth flow is then working as expected. Nice.

kerem commented

2026-03-16 19:49:34 +03:00

Author

Owner

@liyasthomas commented on GitHub (Apr 28, 2024):

cc: @amk-dev can you follow-up this?

@liyasthomas commented on GitHub (Apr 28, 2024): cc: @amk-dev can you follow-up this?

kerem commented

2026-03-16 19:49:39 +03:00

Author

Owner

@kbakeradi commented on GitHub (May 3, 2024):

cc: @amk-dev can you follow-up this?

I have set up the local dev environment for the hoppscotch desktop application and just uncommented the above lines for testing. I can confirm that the auth flow is then working as expected. Nice.
Could you submit a PR for this? I'll try to duplicate your success, but it might help to get this fix into the tool.

@kbakeradi commented on GitHub (May 3, 2024): > cc: @amk-dev can you follow-up this? > I have set up the local dev environment for the hoppscotch desktop application and just uncommented the above lines for testing. I can confirm that the auth flow is then working as expected. Nice. Could you submit a PR for this? I'll try to duplicate your success, but it might help to get this fix into the tool.

kerem referenced this issue

2026-03-17 00:51:58 +03:00

[PR #1319] [MERGED] Query arguments in GraphQL are shown separately with description #3235