starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-26 01:06:00 +03:00

[GH-ISSUE #4972] [bug]: GraphQL collection does not inherits auth #1886

New issue

Open

opened 2026-03-16 22:15:37 +03:00 by kerem · 6 comments

kerem commented

2026-03-16 22:15:37 +03:00

Owner

Originally created by @ytatichno on GitHub (Apr 8, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4972

Originally assigned to: @nivedin on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Current behavior

I have GraphQL query in my desktop Windows client that depends on Bearer authentication(authorization).

I can't use collection token bearer inheritance. And via header field too.

v2025.3.0

Steps to reproduce

Usecase:

I put current auth JWT token with option Bearer, it works.
Then I chose Inherit, created collection, add this query to the collection.
After that I duped this query a few times, and copied different queries in each.
After that I assigned the token to Bearer authentication in the collection properties.
I saved and tried to run queries - queries were failing authentication(authorization).

Some tries:

I tried to change query auth type to Bearer and it worked, then I returned to Inherit, it failed.
Also I tried to switch, then switch back auth type within collection.
And then I tried to add bearer field manually in headers for collection, it also failed.

Logs and Screenshots

Fun part, when I set same token in the collection with Bearer and some query from this collection with Bearer, it had duplicated(with same token) fields in headers and it worked:

^^^It works

But when I set the query auth type back to Inherit and it showed only one field with that token, it failed:

^^^It fails

And exported collection(I manually cut most of queries) if it will help:

hoppscotch-gql-collections.json

Environment

Release

Hoppscotch Version

Local

Interceptor

Native - Desktop App

Browsers Affected

Not applicable (Desktop app)

Operating System

Windows

Additional Information

No response

Originally created by @ytatichno on GitHub (Apr 8, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4972 Originally assigned to: @nivedin on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Current behavior I have GraphQL query in my desktop Windows client that depends on **Bearer** authentication(authorization). ### I can't use collection token bearer inheritance. And via header field too. **v2025.3.0** ### Steps to reproduce Usecase: - I put current auth JWT token with option **Bearer**, it works. - Then I chose **Inherit**, created collection, add this query to the collection. - After that I duped this query a few times, and copied different queries in each. - After that I assigned the token to **Bearer** authentication in the collection **properties**. - I saved and tried to run queries - queries were failing authentication(authorization). Some tries: - I tried to change query auth type to **Bearer** and it worked, then I returned to **Inherit**, it failed. - Also I tried to switch, then switch back auth type within collection. - And then I tried to **add bearer field manually** in headers for collection, it **also failed**. ### Logs and Screenshots Fun part, when I set same token in the collection with **Bearer** and some query from this collection with **Bearer**, it had duplicated(with same token) fields in headers and it worked: ![Image](https://github.com/user-attachments/assets/656b1eb8-f17b-429c-92ad-421520105181) ^^^It works --- But when I set the query auth type back to **Inherit** and it showed only one field with that token, it failed: ![Image](https://github.com/user-attachments/assets/c9cdb1a4-2de4-4349-b203-ebfea34c0352) ^^^It fails And exported collection(I manually cut most of queries) if it will help: [hoppscotch-gql-collections.json](https://github.com/user-attachments/files/19657905/hoppscotch-gql-collections.json) ### Environment Release ### Hoppscotch Version Local ### Interceptor Native - Desktop App ### Browsers Affected Not applicable (Desktop app) ### Operating System Windows ### Additional Information _No response_

kerem added the

bug

need testing

labels

2026-03-16 22:15:37 +03:00

kerem commented

2026-03-16 22:15:48 +03:00

Author

Owner

@nivedin commented on GitHub (Apr 10, 2025):

@ytatichno Thank you for the detailed explanation, we tried to repro the issue with the provided collection and we couldn't find any issue with the properties inheritance flow. Can you let me know the app version you are using.

@nivedin commented on GitHub (Apr 10, 2025): @ytatichno Thank you for the detailed explanation, we tried to repro the issue with the provided collection and we couldn't find any issue with the properties inheritance flow. Can you let me know the app version you are using.

kerem commented

2026-03-16 22:15:53 +03:00

Author

Owner

@ytatichno commented on GitHub (Apr 10, 2025):

@nivedin thank you for your fast reply. I found this in v2025.3.0 in my Windows 11 desktop app as I said, today I updated to v2025.3.1 and nothing changed. There is screen record with bug reproduction:

https://github.com/user-attachments/assets/a17c7bd7-01e8-49d8-b251-304130352277

As you can see, same token causes diffrent answer depends on if it is inherited or not.

@ytatichno commented on GitHub (Apr 10, 2025): @nivedin thank you for your fast reply. I found this in `v2025.3.0` in my Windows 11 desktop app as I said, today I updated to `v2025.3.1` and nothing changed. There is screen record with bug reproduction: https://github.com/user-attachments/assets/a17c7bd7-01e8-49d8-b251-304130352277 As you can see, same token causes diffrent answer depends on if it is inherited or not.

kerem commented

2026-03-16 22:15:58 +03:00

Author

Owner

@ktriple commented on GitHub (Apr 14, 2025):

Interesting, in our regular REST API the JWT is also not inherited with at least the oAuth 2.0 authorization. We just get a really old token that somewhere seems to be saved.

I've looked in all folder properties and unset / set the authoriation tab to inherit, oAuth 2.0 and back.

We're working in both the Web Version directly and the Mac OS app version (25.3.1 - 20250410.084640). Both experience the same issue.

@ktriple commented on GitHub (Apr 14, 2025): Interesting, in our regular REST API the JWT is also not inherited with at least the oAuth 2.0 authorization. We just get a really old token that somewhere seems to be saved. I've looked in all folder properties and unset / set the authoriation tab to inherit, oAuth 2.0 and back. We're working in both the Web Version directly and the Mac OS app version (25.3.1 - 20250410.084640). Both experience the same issue.

kerem commented

2026-03-16 22:16:03 +03:00

Author

Owner

@imironyak commented on GitHub (May 10, 2025):

I have the same issue in both Mac and Web apps (v2025.4.2)

@imironyak commented on GitHub (May 10, 2025): I have the same issue in both Mac and Web apps (v2025.4.2)

kerem commented

2026-03-16 22:16:08 +03:00

Author

Owner

@Shadowghost commented on GitHub (Jun 19, 2025):

This is still happening in 2025.5.3 but it seems like #5154 fixed the inheritance for at least connecting to the GraphQL, but the auth header is still missing when firing the actual query, so collection auth is still essentially broken for GraphQL requests.

@Shadowghost commented on GitHub (Jun 19, 2025): This is still happening in `2025.5.3` but it seems like #5154 fixed the inheritance for at least connecting to the GraphQL, but the auth header is still missing when firing the actual query, so collection auth is still essentially broken for GraphQL requests.

kerem commented

2026-03-16 22:16:13 +03:00

Author

Owner

@Shadowghost commented on GitHub (Jul 30, 2025):

Still broken in 2025.7.0 - the inheritance is properly shown in the GraphQL interface, as is the Authorization header but the actual request does not include the header when executing the query.
Also, the response log seems to be off. Graphql returns 401 but you can only know this if you use the Browser Interceptor and cehck the Dev tool network tab yourself, in the Hoppscotch UI you onle get a "Invalid JSON response" and empty Raw.

@Shadowghost commented on GitHub (Jul 30, 2025): Still broken in 2025.7.0 - the inheritance is properly shown in the GraphQL interface, as is the Authorization header but the actual request does not include the header when executing the query. Also, the response log seems to be off. Graphql returns 401 but you can only know this if you use the Browser Interceptor and cehck the Dev tool network tab yourself, in the Hoppscotch UI you onle get a "Invalid JSON response" and empty Raw.

kerem referenced this issue

2026-03-17 01:09:13 +03:00

[PR #1886] [MERGED] chore(i18n): updated Norwegian translations #3547