[PR #4927] [MERGED] fix(common): oauth2 basic header encoding #4988

New issue

Closed

opened 2026-03-17 02:28:39 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:28:39 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/4927
Author: @qhris
Created: 3/21/2025
Status: ✅ Merged
Merged: 3/28/2025
Merged by: @jamesgeorge007

Base: next ← Head: fix/outh2-basic

📝 Commits (1)

fad0696 fix(common): oauth2 basic header encoding

📊 Changes

1 file changed (+10 additions, -1 deletions)

View changed files

📝 packages/hoppscotch-common/src/services/oauth/flows/clientCredentials.ts (+10 -1)

📄 Description

Fixes the basic auth header encoding in accordance with RFC 6749.

Using OAuth2 and selecting Send credentials as Basis Auth using any client secret with special characters such as +, or § will result in a failure to fetch the token.

According to RFC 6749 section 2.3.1 (the OAuth spec) the client ID and the secret should be encoded in accordance with application/x-www-form-urlencoded.

I you want me to create an issue for this I can, but I had already solved it once I finished debugging.

What's changed

Before base64 encoding the header value, a new function will properly encode the username and password parts separately before encoding it.

As a sidenote, encodeURIComponent encodes spaces as %20 and not + as specified by application/x-www-form-urlencoded. There is a note on the MDN site for this.

Before

Auth:    "user:0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_.,;:-/(){}!+*'#%&<>|§½"
Decoded: "user:0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_.,;-/(){}! *'#%&<>|��"

After

Auth:    "user:0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_.,;:-/(){}!+*'#%&<>|§½"
Decoded: "user:0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_.,;:-/(){}!+*'#%&<>|§½"

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/4927 **Author:** [@qhris](https://github.com/qhris) **Created:** 3/21/2025 **Status:** ✅ Merged **Merged:** 3/28/2025 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `fix/outh2-basic` --- ### 📝 Commits (1) - [`fad0696`](https://github.com/hoppscotch/hoppscotch/commit/fad06969e6d1503e76833871333b421f91c8d6f0) fix(common): oauth2 basic header encoding ### 📊 Changes **1 file changed** (+10 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-common/src/services/oauth/flows/clientCredentials.ts` (+10 -1) </details> ### 📄 Description Fixes the basic auth header encoding in accordance with RFC 6749. Using OAuth2 and selecting `Send credentials as Basis Auth` using any client secret with special characters such as `+`, or `§` will result in a failure to fetch the token. According to [RFC 6749 section 2.3.1](<https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1>) (the OAuth spec) the client ID and the secret should be encoded in accordance with `application/x-www-form-urlencoded`. I you want me to create an issue for this I can, but I had already solved it once I finished debugging. ### What's changed Before base64 encoding the header value, a new function will properly encode the username and password parts separately before encoding it. As a sidenote, `encodeURIComponent` encodes spaces as `%20` and not `+` as specified by `application/x-www-form-urlencoded`. There is a [note on the MDN site](<https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent#description>) for this. ### Before ``` Auth: "user:0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_.,;:-/(){}!+*'#%&<>|§½" Decoded: "user:0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_.,;-/(){}! *'#%&<>|��" ``` ### After ``` Auth: "user:0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_.,;:-/(){}!+*'#%&<>|§½" Decoded: "user:0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_.,;:-/(){}!+*'#%&<>|§½" ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>