starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #4287] [bug]: Can See Collections, Requests, etc...When Logged Out #1560

New issue

Closed

opened 2026-03-16 20:50:22 +03:00 by kerem · 4 comments

kerem commented

2026-03-16 20:50:22 +03:00

Owner

Originally created by @jimmybrancaccio on GitHub (Aug 22, 2024).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4287

Is there an existing issue for this?

I have searched the existing issues

Current behavior

When I leave a Hoppscotch open in a tab for a couple days I am automatically logged out (expected). However when I bring up the tab and even refresh the page I am still seeing my workspace, collections, requests, etc...this is definitely not expected. Of note, I am self-hosting on v2024.7.1.

Steps to reproduce

Setup a self-hosted Hoppscotch instance using v2024.7.1.
Create yourself an account, and log into it.
Create a couple collections with some requests in each of them.
There's probably a way to simulate being automatically logged out, but in my case I'll just have Hoppscotch open in a tab in my web browser and won't use it for a few days. When I come back to it, it's automatically logged me out.
Observe that you're still able to see your collections, requests, etc...while not being logged in.
Observe that even after refreshing the page/tab still shows your collections, requests, etc...

Environment

Production

Version

Self-hosted

Originally created by @jimmybrancaccio on GitHub (Aug 22, 2024). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4287 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior When I leave a Hoppscotch open in a tab for a couple days I am automatically logged out (expected). However when I bring up the tab and even refresh the page I am still seeing my workspace, collections, requests, etc...this is definitely not expected. Of note, I am self-hosting on v2024.7.1. ### Steps to reproduce 1. Setup a self-hosted Hoppscotch instance using v2024.7.1. 2. Create yourself an account, and log into it. 3. Create a couple collections with some requests in each of them. 4. There's probably a way to simulate being automatically logged out, but in my case I'll just have Hoppscotch open in a tab in my web browser and won't use it for a few days. When I come back to it, it's automatically logged me out. 5. Observe that you're still able to see your collections, requests, etc...while not being logged in. 6. Observe that even after refreshing the page/tab still shows your collections, requests, etc... ### Environment Production ### Version Self-hosted

kerem

2026-03-16 20:50:22 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 20:50:38 +03:00

Author

Owner

@liyasthomas commented on GitHub (Aug 23, 2024):

Thank you for bringing this to our attention.

This behavior is expected due to the way Hoppscotch manages personal workspace data. When you use Hoppscotch, your workspace, collections, and requests are initially stored in your browser's local storage. This allows you to work offline and ensures that your data is available even if you're not actively connected to the internet or logged in.

When you're automatically logged out after a period of inactivity, Hoppscotch retains your workspace data locally. That's why, even though you're logged out, you can still see your collections and requests. Refreshing the page doesn't clear this local storage, so your data remains visible.

To fully clear this data, you would need to manually clear your browser's local storage or log back into your account, at which point Hoppscotch will resync with the cloud and ensure that only data associated with your logged-in account is accessible.

If this behavior is a concern for your use case, consider logging out manually after each session and clearing offline data associated with Hoppscotch to avoid leaving data accessible on your device.

See this guide for Chrome browser:
How to Automatically Clear Browsing Data When Closing Google Chrome Window: A Step-by-Step Guide

Let us know if you have any other questions or concerns!

@liyasthomas commented on GitHub (Aug 23, 2024): Thank you for bringing this to our attention. This behavior is expected due to the way Hoppscotch manages personal workspace data. When you use Hoppscotch, your workspace, collections, and requests are initially stored in your browser's local storage. This allows you to work offline and ensures that your data is available even if you're not actively connected to the internet or logged in. When you're automatically logged out after a period of inactivity, Hoppscotch retains your workspace data locally. That's why, even though you're logged out, you can still see your collections and requests. Refreshing the page doesn't clear this local storage, so your data remains visible. To fully clear this data, you would need to manually clear your browser's local storage or log back into your account, at which point Hoppscotch will resync with the cloud and ensure that only data associated with your logged-in account is accessible. If this behavior is a concern for your use case, consider logging out manually after each session and clearing offline data associated with Hoppscotch to avoid leaving data accessible on your device. See this guide for Chrome browser: [How to Automatically Clear Browsing Data When Closing Google Chrome Window: A Step-by-Step Guide](https://support.google.com/chrome/community-guide/245444314/how-to-automatically-clear-browsing-data-when-closing-google-chrome-window-a-step-by-step-guide?hl=en) Let us know if you have any other questions or concerns!

kerem commented

2026-03-16 20:50:43 +03:00

Author

Owner

@jimmybrancaccio commented on GitHub (Aug 23, 2024):

Interesting. I've just never come across a piece of software or service that shares/shows data specific to an account when the account is not logged in. 🤨🤷🏼

@jimmybrancaccio commented on GitHub (Aug 23, 2024): Interesting. I've just never come across a piece of software or service that shares/shows data specific to an account when the account is not logged in. 🤨🤷🏼

kerem commented

2026-03-16 20:50:48 +03:00

Author

Owner

@jimmybrancaccio commented on GitHub (Jul 22, 2025):

@liyasthomas Apologies to resurrect this almost a year later. I understand your use case and while it seems a little weird, can you confirm it only allows you to work on things within your personal workspace? It doesn't allow you access to your other workspaces you've created, and requests within them, right? If so, how come?

Thanks! ☺️

@jimmybrancaccio commented on GitHub (Jul 22, 2025): @liyasthomas Apologies to resurrect this almost a year later. I understand your use case and while it seems a little weird, can you confirm it only allows you to work on things within your personal workspace? It doesn't allow you access to your other workspaces you've created, and requests within them, right? If so, how come? Thanks! ☺️

kerem commented

2026-03-16 20:50:53 +03:00

Author

Owner

@edlyra commented on GitHub (Mar 6, 2026):

Thanks for the clarification on why this was closed.

I understand the current behavior is intentional to preserve offline/disconnected continuity, which makes sense.

However, I think there is still room for an optional privacy-focused improvement: allowing users to choose whether local collections/environments/workspace data should be cleared on explicit logout only.

To avoid mixing this with the original closed issue, I will open a separate feature request for that proposal and reference this discussion there.

@edlyra commented on GitHub (Mar 6, 2026): Thanks for the clarification on why this was closed. I understand the current behavior is intentional to preserve offline/disconnected continuity, which makes sense. However, I think there is still room for an optional privacy-focused improvement: allowing users to choose whether local collections/environments/workspace data should be cleared on explicit logout only. To avoid mixing this with the original closed issue, I will open a separate feature request for that proposal and reference this discussion there.

kerem referenced this issue

2026-03-17 01:00:58 +03:00

[PR #1560] [MERGED] Revamp of the Settings State System along with TypeScript support #3398