[PR #5287] [MERGED] feat(common): support advanced parameters in `implicit`, `password`, and `client_credentials` grant types #5143

New issue

Closed

opened 2026-03-17 02:37:07 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:37:07 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5287
Author: @anwarulislam
Created: 7/29/2025
Status: ✅ Merged
Merged: 8/27/2025
Merged by: @jamesgeorge007

Base: next ← Head: feat/enhance-oauth2

📝 Commits (10+)

1e3108c refactor(auth): simplify sendInOptions structure and add labels
53fa468 feat: add advanced OAuth2 parameters management and grant types handling
3dd7cc1 refactor: reorder sendInOptions and update labels for clarity
b4a2d37 refactor: streamline parameter preparation by introducing prepareRequestParams function
63a7b0c feat: password flow with token request and refresh parameters handling
cf118e4 feat: Implicit OAuth flow to include authRequestParams and refreshRequestParams handling
45d8d45 feat: implement refresh token handling and enhance token request parameter management
a5a60ab feat: implement unified refresh token function for all OAuth flows
e1c9ba5 feat: enhance request parameter handling by introducing computed properties for auth, token, and refresh request parameters
9078cdc fix: remove conditional rendering for authCode grant type to simplify template structure

📊 Changes

9 files changed (+1676 additions, -1396 deletions)

View changed files

📝 packages/hoppscotch-common/src/components/http/authorization/OAuth2.vue (+195 -1204)
➕ packages/hoppscotch-common/src/composables/oauth2/useOAuth2AdvancedParams.ts (+301 -0)
➕ packages/hoppscotch-common/src/composables/oauth2/useOAuth2GrantTypes.ts (+824 -0)
📝 packages/hoppscotch-common/src/helpers/oauth2Params.ts (+6 -14)
📝 packages/hoppscotch-common/src/services/oauth/flows/authCode.ts (+5 -74)
📝 packages/hoppscotch-common/src/services/oauth/flows/clientCredentials.ts (+115 -52)
📝 packages/hoppscotch-common/src/services/oauth/flows/implicit.ts (+33 -12)
📝 packages/hoppscotch-common/src/services/oauth/flows/password.ts (+75 -40)
➕ packages/hoppscotch-common/src/services/oauth/utils.ts (+122 -0)

📄 Description

Added support for advanced parameters in implicit, password and client_credentials grant types. And refactor the OAuth2 component.

Note for reviewers

Download and import the collection(auth-types.json). All necessary credentials are there already. There's a sample backend code in a comment. You can run it to test the token.

1. Test implicit flow.

Toggle audience parameter
Generate token
Send request

If you generate a token for the right audience, it'll be valid, and you'll get a successful response. If not, the server will throw an error message.

2. Test password flow.

Change the URL endpoint. Replace /audience with /oauth/token
Toggle audience parameter in Token Request section in Advanced Settings
Generate token
Send request

If you generate a token for the right audience, it'll be valid, and you'll get a successful response. If not, the server will throw an error message.

3. Test credentials flow.

Change the URL endpoint. Replace /audience with /oauth/token
Toggle audience parameter in Token Request section in Advanced Settings
Make sure you’re using <<client_m2m>> and <<secret_m2m>>. The credentials grant type only works with machine-to-machine.
Generate token
Send request

If you don't pass the right audience, the token will not be generated and you'll get error response.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5287 **Author:** [@anwarulislam](https://github.com/anwarulislam) **Created:** 7/29/2025 **Status:** ✅ Merged **Merged:** 8/27/2025 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `feat/enhance-oauth2` --- ### 📝 Commits (10+) - [`1e3108c`](https://github.com/hoppscotch/hoppscotch/commit/1e3108ca9859a3b2843fb1f7e090dbb74cacd872) refactor(auth): simplify sendInOptions structure and add labels - [`53fa468`](https://github.com/hoppscotch/hoppscotch/commit/53fa46826e1ba346696c31d76937458704b10bc3) feat: add advanced OAuth2 parameters management and grant types handling - [`3dd7cc1`](https://github.com/hoppscotch/hoppscotch/commit/3dd7cc1e6e0b349ab103f32619b3c49896894b3f) refactor: reorder sendInOptions and update labels for clarity - [`b4a2d37`](https://github.com/hoppscotch/hoppscotch/commit/b4a2d37532fe72667823761a1ea014ae624a0dca) refactor: streamline parameter preparation by introducing prepareRequestParams function - [`63a7b0c`](https://github.com/hoppscotch/hoppscotch/commit/63a7b0c0378c41ce17f37cd89329971697fe7988) feat: password flow with token request and refresh parameters handling - [`cf118e4`](https://github.com/hoppscotch/hoppscotch/commit/cf118e45f540b4e51d1b60db27069dcf9d837d1c) feat: Implicit OAuth flow to include authRequestParams and refreshRequestParams handling - [`45d8d45`](https://github.com/hoppscotch/hoppscotch/commit/45d8d45f2ba57311e4fb96a2dc824046fa84e7eb) feat: implement refresh token handling and enhance token request parameter management - [`a5a60ab`](https://github.com/hoppscotch/hoppscotch/commit/a5a60abb969807f3ec3ced1c57d3afb19dbf75c4) feat: implement unified refresh token function for all OAuth flows - [`e1c9ba5`](https://github.com/hoppscotch/hoppscotch/commit/e1c9ba566fce540d1885f93932b78f8608ca6a92) feat: enhance request parameter handling by introducing computed properties for auth, token, and refresh request parameters - [`9078cdc`](https://github.com/hoppscotch/hoppscotch/commit/9078cdcba5b8497f4734028084013d87cbdc0a95) fix: remove conditional rendering for authCode grant type to simplify template structure ### 📊 Changes **9 files changed** (+1676 additions, -1396 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-common/src/components/http/authorization/OAuth2.vue` (+195 -1204) ➕ `packages/hoppscotch-common/src/composables/oauth2/useOAuth2AdvancedParams.ts` (+301 -0) ➕ `packages/hoppscotch-common/src/composables/oauth2/useOAuth2GrantTypes.ts` (+824 -0) 📝 `packages/hoppscotch-common/src/helpers/oauth2Params.ts` (+6 -14) 📝 `packages/hoppscotch-common/src/services/oauth/flows/authCode.ts` (+5 -74) 📝 `packages/hoppscotch-common/src/services/oauth/flows/clientCredentials.ts` (+115 -52) 📝 `packages/hoppscotch-common/src/services/oauth/flows/implicit.ts` (+33 -12) 📝 `packages/hoppscotch-common/src/services/oauth/flows/password.ts` (+75 -40) ➕ `packages/hoppscotch-common/src/services/oauth/utils.ts` (+122 -0) </details> ### 📄 Description Added support for advanced parameters in `implicit`, `password` and `client_credentials` grant types. And refactor the OAuth2 component. ## Note for reviewers Download and import the collection([auth-types.json](https://github.com/user-attachments/files/21708016/auth-types.json)). All necessary credentials are there already. There's a sample backend code in a [comment](#issuecomment-3172969848). You can run it to test the token. #### 1. Test implicit flow. - Toggle audience parameter - Generate token - Send request If you generate a token for the right audience, it'll be valid, and you'll get a successful response. If not, the server will throw an error message. <img width="824" height="613" alt="image" src="https://github.com/user-attachments/assets/c260f466-c56b-4242-94b1-141514842e5a" /> #### 2. Test password flow. - Change the URL endpoint. Replace `/audience` with `/oauth/token` - Toggle audience parameter in `Token Request` section in `Advanced Settings` - Generate token - Send request If you generate a token for the right audience, it'll be valid, and you'll get a successful response. If not, the server will throw an error message. <img width="658" height="771" alt="image" src="https://github.com/user-attachments/assets/1ee1aa9a-9b5c-47c1-ae55-c1a1e6424bc6" /> #### 3. Test credentials flow. - Change the URL endpoint. Replace `/audience` with `/oauth/token` - Toggle audience parameter in `Token Request` section in `Advanced Settings` - Make sure you’re using `<<client_m2m>>` and `<<secret_m2m>>`. The credentials grant type only works with machine-to-machine. - Generate token - Send request If you don't pass the right audience, the token will not be generated and you'll get error response. <img width="890" height="802" alt="image" src="https://github.com/user-attachments/assets/b54f8c5e-d515-45a0-9b72-415891b680ec" /> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>