starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #5358] [bug]: Authorization code flow not starting with PKCE #2048

New issue

Closed

opened 2026-03-16 22:58:43 +03:00 by kerem · 10 comments

kerem commented

2026-03-16 22:58:43 +03:00

Owner

Originally created by @macmessa on GitHub (Aug 28, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5358

Originally assigned to: @anwarulislam on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Platform

Web App/Desktop App

Browser

Edge Version 134.0.3124.72

Operating System

Windows

Bug Description

Since lots of the apps created in our authorization server are public clients, they implement the PKCE for client authentication.
I've tried to set an authorization code flow with PKCE, so the label Code Challenge shows up, but with no additional fields like Code Verifier and Code Challenge Method, I think this might be triggering a form validation when I click Generate Token, requesting these fields (they are needed).

Deployment Type

Self-hosted (on-prem deployment)

Version

v2025.7.1

Originally created by @macmessa on GitHub (Aug 28, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5358 Originally assigned to: @anwarulislam on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Platform Web App/Desktop App ### Browser Edge Version 134.0.3124.72 ### Operating System Windows ### Bug Description Since lots of the apps created in our authorization server are public clients, they implement the PKCE for client authentication. I've tried to set an authorization code flow with PKCE, so the label `Code Challenge` shows up, but with no additional fields like `Code Verifier` and `Code Challenge Method`, I think this might be triggering a form validation when I click `Generate Token`, requesting these fields (they are needed). <img width="893" height="871" alt="Image" src="https://github.com/user-attachments/assets/19679dce-f7de-4e76-979e-db805ec449b4" /> ### Deployment Type Self-hosted (on-prem deployment) ### Version v2025.7.1

kerem

2026-03-16 22:58:43 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-16 22:58:59 +03:00

Author

Owner

@Gandhi11 commented on GitHub (Sep 18, 2025):

Same problem here. I think the "algorithms" dropdown should be shown which is not the case at the moment.

@Gandhi11 commented on GitHub (Sep 18, 2025): Same problem here. I think the "algorithms" dropdown should be shown which is not the case at the moment.

kerem commented

2026-03-16 22:59:04 +03:00

Author

Owner

@Gandhi11 commented on GitHub (Sep 18, 2025):

In local development the dropdown is there. But not in builded web app or desktop app.

@Gandhi11 commented on GitHub (Sep 18, 2025): In local development the dropdown is there. But not in builded web app or desktop app. <img width="482" height="266" alt="Image" src="https://github.com/user-attachments/assets/3ad9a27a-32ef-4516-9733-0adb6eca0f07" />

kerem commented

2026-03-16 22:59:09 +03:00

Author

Owner

@Gandhi11 commented on GitHub (Sep 19, 2025):

@macmessa Is the collection you are trying to add this is a imported collection? On my side it seems to work when it is a completely new collection...

@Gandhi11 commented on GitHub (Sep 19, 2025): @macmessa Is the collection you are trying to add this is a imported collection? On my side it seems to work when it is a completely new collection...

kerem commented

2026-03-16 22:59:15 +03:00

Author

Owner

@macmessa commented on GitHub (Sep 19, 2025):

@macmessa Is the collection you are trying to add this is a imported collection? On my side it seems to work when it is a completely new collection...

Yes, turns out it was because it was an imported collection, I had to create a new one and recreate all of the endpoints, making the import useless for me, in this case.

@macmessa commented on GitHub (Sep 19, 2025): > @macmessa Is the collection you are trying to add this is a imported collection? On my side it seems to work when it is a completely new collection... Yes, turns out it was because it was an imported collection, I had to create a new one and recreate all of the endpoints, making the import useless for me, in this case.

kerem commented

2026-03-16 22:59:20 +03:00

Author

Owner

@anwarulislam commented on GitHub (Oct 6, 2025):

Hello @Gandhi11, @macmessa,

Following the discussion, it seems that the issue may not be related to the PKCE implementation. The problem pertains to the failure to display all the required fields after the import of collections. However, when a new collection is created, it functions correctly. Could you please confirm if this is accurate or provide further details?

@anwarulislam commented on GitHub (Oct 6, 2025): Hello @Gandhi11, @macmessa, Following the discussion, it seems that the issue may not be related to the PKCE implementation. The problem pertains to the failure to display all the required fields after the import of collections. However, when a new collection is created, it functions correctly. Could you please confirm if this is accurate or provide further details?

kerem commented

2026-03-16 22:59:25 +03:00

Author

Owner

@macmessa commented on GitHub (Oct 6, 2025):

Hello @Gandhi11, @macmessa,

Following the discussion, it seems that the issue may not be related to the PKCE implementation. The problem pertains to the failure to display all the required fields after the import of collections. However, when a new collection is created, it functions correctly. Could you please confirm if this is accurate or provide further details?

Exactly, only fails when it's a n imported collection, it does not display all required fields.

@macmessa commented on GitHub (Oct 6, 2025): > Hello @Gandhi11, @macmessa, > > Following the discussion, it seems that the issue may not be related to the PKCE implementation. The problem pertains to the failure to display all the required fields after the import of collections. However, when a new collection is created, it functions correctly. Could you please confirm if this is accurate or provide further details? Exactly, only fails when it's a n imported collection, it does not display all required fields.

kerem commented

2026-03-16 22:59:30 +03:00

Author

Owner

@anwarulislam commented on GitHub (Oct 6, 2025):

@macmessa, thanks for the confirmation.

@anwarulislam commented on GitHub (Oct 6, 2025): @macmessa, thanks for the confirmation.

kerem commented

2026-03-16 22:59:35 +03:00

Author

Owner

@Gandhi11 commented on GitHub (Oct 9, 2025):

@anwarulislam After investigating the TeamCollection entry in the database. It look like the required key codeVerifierMethod is missing in the auth key of the data column. I think it should be "plain" or "S256".

Here's a look at the data after the postman importation.

{
"auth": {
    "addTo": "HEADERS",
    "authType": "oauth-2",
    "authActive": true,
    "grantTypeInfo": {
      "token": "",
      "isPKCE": true,
      "scopes": "",
      "clientID": "<<ClientID>>",
      "grantType": "AUTHORIZATION_CODE",
      "authEndpoint": "XXXX",
      "clientSecret": "<<ClientSecret>>",
      "tokenEndpoint": "XXXXXX",
      "authRequestParams": [],
      "tokenRequestParams": [],
      "refreshRequestParams": []
    }
  },
  ...
}

Here's a look at the data on a working collection.

{
"auth": {
    "addTo": "HEADERS",
    "authType": "oauth-2",
    "authActive": true,
    "grantTypeInfo": {
      "token": "",
      "isPKCE": true,
      "scopes": "",
      "clientID": "<<ClientID>>",
      "grantType": "AUTHORIZATION_CODE",
      "authEndpoint": "XXXX",
      "clientSecret": "<<ClientSecret>>",
      "tokenEndpoint": "XXXXXX",
      "authRequestParams": [],
      "codeVerifierMethod": "S256",
      "tokenRequestParams": [],
      "refreshRequestParams": []
    }
  },
  ...
}

Hope this help.

@Gandhi11 commented on GitHub (Oct 9, 2025): @anwarulislam After investigating the TeamCollection entry in the database. It look like the required key **_codeVerifierMethod_** is missing in the auth key of the data column. I think it should be "plain" or "S256". Here's a look at the data after the postman importation. ``` { "auth": { "addTo": "HEADERS", "authType": "oauth-2", "authActive": true, "grantTypeInfo": { "token": "", "isPKCE": true, "scopes": "", "clientID": "<<ClientID>>", "grantType": "AUTHORIZATION_CODE", "authEndpoint": "XXXX", "clientSecret": "<<ClientSecret>>", "tokenEndpoint": "XXXXXX", "authRequestParams": [], "tokenRequestParams": [], "refreshRequestParams": [] } }, ... } ``` Here's a look at the data on a working collection. ``` { "auth": { "addTo": "HEADERS", "authType": "oauth-2", "authActive": true, "grantTypeInfo": { "token": "", "isPKCE": true, "scopes": "", "clientID": "<<ClientID>>", "grantType": "AUTHORIZATION_CODE", "authEndpoint": "XXXX", "clientSecret": "<<ClientSecret>>", "tokenEndpoint": "XXXXXX", "authRequestParams": [], "codeVerifierMethod": "S256", "tokenRequestParams": [], "refreshRequestParams": [] } }, ... } ``` Hope this help.

kerem commented

2026-03-16 22:59:40 +03:00

Author

Owner

@anwarulislam commented on GitHub (Oct 13, 2025):

@Gandhi11, I just submitted the PR. It is expected to address the issue. If you could confirm and verify the changes, it would be greatly appreciated. Please inform me if it is functioning correctly.

@anwarulislam commented on GitHub (Oct 13, 2025): @Gandhi11, I just submitted the PR. It is expected to address the issue. If you could confirm and verify the changes, it would be greatly appreciated. Please inform me if it is functioning correctly.

kerem commented

2026-03-16 22:59:45 +03:00

Author

Owner

@jamesgeorge007 commented on GitHub (Oct 31, 2025):

Hi, closing this issue since the patch is now live with the latest release. Please feel free to share any feedback.

@jamesgeorge007 commented on GitHub (Oct 31, 2025): Hi, closing this issue since the patch is now live with the [latest release](https://github.com/hoppscotch/hoppscotch/releases/tag/2025.10.0). Please feel free to share any feedback.

kerem referenced this issue

2026-03-17 01:12:45 +03:00

[PR #2048] [MERGED] Bug/body missing onimport #3612