starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #5939] [bug]: Authorization inheritance broken for requests inside subfolders #2333

New issue

Open

opened 2026-03-16 23:59:56 +03:00 by kerem · 5 comments

kerem commented

2026-03-16 23:59:56 +03:00

Owner

Originally created by @Laeborg on GitHub (Mar 4, 2026).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5939

Originally assigned to: @VishwaVikas2006 on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Platform

Web App

Browser

Firefox

Operating System

Linux

Bug Description

What happened

OAuth 2.0 authorization inheritance does not work for requests placed inside subfolders. Requests at the top-level of a collection correctly inherit authorization set on the parent folder, but requests inside any subfolder fail to inherit authorization — regardless of whether the authorization is set on the top-level folder or on the subfolder itself.

Authorization inheritance only works one level deep. Requests in subfolders do not receive the inherited token, making it impossible to use inherited OAuth 2.0 auth in nested folder structures.

What I expected is

Requests inside subfolders should inherit OAuth 2.0 authorization from their parent folder or the root collection, consistent with how inheritance works for top-level requests.

Steps to reproduce

Create a collection with OAuth 2.0 authorization configured.
Create a subfolder inside the collection.
Place a request inside the subfolder and set its authorization to Inherit from parent.
Send the request — no authorization token is applied.

Additional context

Authorization set directly on a request (not inherited) works fine at any nesting level.
The issue appears to be specific to OAuth 2.0 — other auth types have not been tested.

Deployment Type

Self-hosted (on-prem deployment)

Version

2026.2.0

Originally created by @Laeborg on GitHub (Mar 4, 2026). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5939 Originally assigned to: @VishwaVikas2006 on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Platform Web App ### Browser Firefox ### Operating System Linux ### Bug Description ## What happened OAuth 2.0 authorization inheritance does not work for requests placed inside subfolders. Requests at the top-level of a collection correctly inherit authorization set on the parent folder, but requests inside any subfolder fail to inherit authorization — regardless of whether the authorization is set on the top-level folder or on the subfolder itself. Authorization inheritance only works one level deep. Requests in subfolders do not receive the inherited token, making it impossible to use inherited OAuth 2.0 auth in nested folder structures. ## What I expected is Requests inside subfolders should inherit OAuth 2.0 authorization from their parent folder or the root collection, consistent with how inheritance works for top-level requests. ## Steps to reproduce 1. Create a collection with OAuth 2.0 authorization configured. 2. Create a subfolder inside the collection. 3. Place a request inside the subfolder and set its authorization to Inherit from parent. 4. Send the request — no authorization token is applied. ## Additional context - Authorization set directly on a request (not inherited) works fine at any nesting level. - The issue appears to be specific to OAuth 2.0 — other auth types have not been tested. ### Deployment Type Self-hosted (on-prem deployment) ### Version 2026.2.0

kerem added the

bug

need testing

labels

2026-03-16 23:59:56 +03:00

kerem commented

2026-03-17 00:00:07 +03:00

Author

Owner

@VishwaVikas2006 commented on GitHub (Mar 12, 2026):

Hi! I noticed this issue is currently assigned to @nivedin.

If it's still open for contributions, I'd be happy to help investigate or work on a fix. I can try reproducing the issue locally and share findings.

@VishwaVikas2006 commented on GitHub (Mar 12, 2026): Hi! I noticed this issue is currently assigned to @nivedin. If it's still open for contributions, I'd be happy to help investigate or work on a fix. I can try reproducing the issue locally and share findings.

kerem commented

2026-03-17 00:00:12 +03:00

Author

Owner

@VishwaVikas2006 commented on GitHub (Mar 12, 2026):

I tested this locally and was able to reproduce the issue.

Requests inside a subfolder do not inherit OAuth authorization, while requests one level deep do inherit it correctly.

I'll start looking into the inheritance logic to identify where the folder hierarchy traversal stops.

@VishwaVikas2006 commented on GitHub (Mar 12, 2026): I tested this locally and was able to reproduce the issue. Requests inside a subfolder do not inherit OAuth authorization, while requests one level deep do inherit it correctly. I'll start looking into the inheritance logic to identify where the folder hierarchy traversal stops.

kerem commented

2026-03-17 00:00:17 +03:00

Author

Owner

@nivedin commented on GitHub (Mar 12, 2026):

I tested this locally and was able to reproduce the issue.

Requests inside a subfolder do not inherit OAuth authorization, while requests one level deep do inherit it correctly.

I'll start looking into the inheritance logic to identify where the folder hierarchy traversal stops.

Assigning it to you @VishwaVikas2006

@nivedin commented on GitHub (Mar 12, 2026): > I tested this locally and was able to reproduce the issue. > > Requests inside a subfolder do not inherit OAuth authorization, while requests one level deep do inherit it correctly. > > I'll start looking into the inheritance logic to identify where the folder hierarchy traversal stops. Assigning it to you @VishwaVikas2006

kerem commented

2026-03-17 00:00:22 +03:00

Author

Owner

@VishwaVikas2006 commented on GitHub (Mar 12, 2026):

I tested this locally on the latest main branch.

Setup:

Collection authorization: OAuth 2.0
Request authorization: Inherit
Folder structure:

Collection
└── Folder
└── Request

Result:
The request correctly inherits OAuth 2.0 authorization from the parent collection even when placed inside a subfolder.

I was unable to reproduce the issue in this configuration. Could you confirm if there are additional conditions required to trigger it (e.g., deeper nesting levels, specific OAuth grant types, or token generation flow)?

I'll also start looking through the inheritance logic to see how the folder traversal is implemented.

@VishwaVikas2006 commented on GitHub (Mar 12, 2026): I tested this locally on the latest `main` branch. Setup: * Collection authorization: OAuth 2.0 * Request authorization: Inherit * Folder structure: Collection └── Folder └── Request Result: The request correctly inherits OAuth 2.0 authorization from the parent collection even when placed inside a subfolder. I was unable to reproduce the issue in this configuration. Could you confirm if there are additional conditions required to trigger it (e.g., deeper nesting levels, specific OAuth grant types, or token generation flow)? I'll also start looking through the inheritance logic to see how the folder traversal is implemented.

kerem commented

2026-03-17 00:00:27 +03:00

Author

Owner

@Laeborg commented on GitHub (Mar 16, 2026):

In this example inherits won't work, no matter if the OAuth 2.0 are set on "api-core" or "tenants" folders. If I set the authorization on "api-core" and move the request to the "api-core" instead for "tenants" then it works. If I set authorization directly on the request and then change it to "inherit" afterwards it seems to save the old authorization in the background, which can make it seems like it is working.

I'm on 2026.2.1.

@Laeborg commented on GitHub (Mar 16, 2026): <img width="260" height="206" alt="Image" src="https://github.com/user-attachments/assets/d3d69ec3-999a-4e68-9d9b-6a2dcd5eb395" /> In this example inherits won't work, no matter if the OAuth 2.0 are set on "api-core" or "tenants" folders. If I set the authorization on "api-core" and move the request to the "api-core" instead for "tenants" then it works. If I set authorization directly on the request and then change it to "inherit" afterwards it seems to save the old authorization in the background, which can make it seems like it is working. I'm on 2026.2.1.

kerem referenced this issue

2026-03-17 01:21:14 +03:00

[PR #2373] [MERGED] feat: added support for passing env.json file to test cmd #3766