[PR #5407] [CLOSED] feat: Configurable Automatic Redirect following for Requests (#2095) #5195

New issue

Closed

opened 2026-03-17 02:39:51 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:39:51 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5407
Author: @Manohar-ford
Created: 9/26/2025
Status: ❌ Closed

Base: main ← Head: Follow-Redirects

📝 Commits (6)

92236b7 feat: add followRedirects option to requests and update related handling
3e5b482 fix: update theme color from indigo to purple
3fb2d5c feat: add FOLLOW_REDIRECTS option to configuration
8c622c5 Update packages/hoppscotch-common/src/newstore/settings.ts
3eed39d Update packages/hoppscotch-selfhost-desktop/src/platform/interceptors/native/index.ts
2f86094 feat: enhance request handling with follow_redirects support

📊 Changes

29 files changed (+330 additions, -210 deletions)

View changed files

📝 packages/hoppscotch-common/locales/en.json (+1 -0)
📝 packages/hoppscotch-common/src/helpers/functional/process-request.ts (+8 -1)
📝 packages/hoppscotch-common/src/helpers/graphql/connection.ts (+4 -0)
📝 packages/hoppscotch-common/src/helpers/kernel/gql/request.ts (+4 -0)
📝 packages/hoppscotch-common/src/helpers/kernel/rest/request.ts (+6 -2)
📝 packages/hoppscotch-common/src/kernel/relay.ts (+8 -1)
📝 packages/hoppscotch-common/src/newstore/settings.ts (+2 -0)
📝 packages/hoppscotch-common/src/pages/settings.vue (+9 -0)
📝 packages/hoppscotch-common/src/platform/std/interceptors/proxy.ts (+2 -1)
📝 packages/hoppscotch-common/src/platform/std/kernel-interceptors/browser/index.ts (+1 -1)
📝 packages/hoppscotch-common/src/platform/std/kernel-interceptors/extension/index.ts (+11 -8)
📝 packages/hoppscotch-common/src/platform/std/kernel-interceptors/native/store.ts (+4 -1)
📝 packages/hoppscotch-common/src/platform/std/kernel-interceptors/proxy/index.ts (+6 -3)
📝 packages/hoppscotch-common/src/services/kernel-interceptor.service.ts (+2 -1)
📝 packages/hoppscotch-common/src/services/persistence/validation-schemas/index.ts (+1 -0)
📝 packages/hoppscotch-desktop/plugin-workspace/relay/src/interop.rs (+1 -0)
📝 packages/hoppscotch-desktop/plugin-workspace/relay/src/request.rs (+25 -46)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/Cargo.toml (+1 -1)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/dist-js/index.d.ts (+2 -1)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/dist-js/index.d.ts.map (+1 -1)

...and 9 more files

📄 Description

Closes #2095

This Pull Request introduces a new, user-configurable option to control how Hoppscotch handles HTTP redirects (e.g., 301, 302, 307, 308). It provides the ability to either automatically follow redirects or explicitly disable this behavior, directly addressing the limitations and user requests outlined in Issue #2095. This change offers greater control and visibility into HTTP request flows, especially for debugging and inspecting intermediate responses.

What's changed

This PR implements a globally configurable and per-request controllable "Follow Redirects" capability across all Hoppscotch clients (web, desktop, self-hosted, kernel relay).

New FOLLOW_REDIRECTS Setting:
- A new setting FOLLOW_REDIRECTS (default: true) has been added to the settings store (packages/hoppscotch-common/src/newstore/settings.ts). This ensures backward compatibility, as existing users will inherit the default behavior.
Per-Request followRedirects Option:
- A followRedirects boolean option is now propagated through REST, GraphQL, and Kernel relay requests. This option takes precedence over the global setting.
Unified Redirect Handling:
- The followRedirects flag is integrated into the Kernel relay request model (packages/hoppscotch-kernel/src/relay/v/1.ts) and is preserved across internal adapters and interceptor layers (web/proxy and native/desktop paths).
- This ensures consistent behavior across all platforms and prevents the option from being stripped during request processing.
Redirect Chain Exposure:
- When FOLLOW_REDIRECTS is enabled, the redirect chain (an array of { status, location, method?, url? }) is recorded and surfaced via the existing redirects response field, contingent on backend capabilities.
Explicit Control Over 3xx Responses:
- When FOLLOW_REDIRECTS is disabled (either globally or per-request), Hoppscotch will now return the first 3xx response immediately to the UI. This allows users to inspect the Location header and other metadata without further redirect resolution.

Notes to reviewers

Motivation: This feature directly addresses the long-standing request in #2095, allowing users to inspect Location headers for debugging authentication flows, security analysis, and understanding redirect chains, which was previously impossible due to implicit handling by underlying transport layers.
Testing: Manual tests were performed covering REST and GraphQL requests to known redirecting URLs, verifying correct behavior when followRedirects is true (final response, redirect chain present) and false (3xx response returned, Location header visible). Parity between desktop and web clients was confirmed.
Integrity: Comments (CRITICAL markers) have been added to prevent accidental stripping of request.options during request cloning or transformation, ensuring followRedirects persists through various pipeline stages.
Out of Scope (for this PR):
- This PR does not include UI wiring for the new toggle. A follow-up PR will be needed to expose this setting in the Hoppscotch UI (e.g., in the request advanced settings panel).
- No custom maximum redirect limit is introduced; this relies on underlying environment defaults.
- No analytics instrumentation is added.
Edge Cases: Considered and confirmed that underlying transport layers handle redirect loops (by their own limits), mixed protocol redirects, relative Location headers, and method rewriting on 301/302/303.
Security: Disabling auto-follow can aid in inspecting potential open redirect vulnerabilities. No changes to credential/cookie handling or protocol upgrades/downgrades beyond existing behavior.
Follow-Ups: Future work includes UI implementation, visual exposure of the redirect chain in the response viewer, adding automated tests, potentially surfacing maxRedirects as a global setting, and updating documentation.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5407 **Author:** [@Manohar-ford](https://github.com/Manohar-ford) **Created:** 9/26/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `Follow-Redirects` --- ### 📝 Commits (6) - [`92236b7`](https://github.com/hoppscotch/hoppscotch/commit/92236b7c96782581419e5935b55dcd98193e4f92) feat: add followRedirects option to requests and update related handling - [`3e5b482`](https://github.com/hoppscotch/hoppscotch/commit/3e5b4828b520c555b7f7846c1cee37b71f1478cc) fix: update theme color from indigo to purple - [`3fb2d5c`](https://github.com/hoppscotch/hoppscotch/commit/3fb2d5c42bb31b970772edd369be8522573cb252) feat: add FOLLOW_REDIRECTS option to configuration - [`8c622c5`](https://github.com/hoppscotch/hoppscotch/commit/8c622c5300d65352beaa7413ce7cc38242bfc9e6) Update packages/hoppscotch-common/src/newstore/settings.ts - [`3eed39d`](https://github.com/hoppscotch/hoppscotch/commit/3eed39dedd3bad2df87b5219418acd0cfa6c6d77) Update packages/hoppscotch-selfhost-desktop/src/platform/interceptors/native/index.ts - [`2f86094`](https://github.com/hoppscotch/hoppscotch/commit/2f8609407228f467f51e995660dc46be44c77716) feat: enhance request handling with follow_redirects support ### 📊 Changes **29 files changed** (+330 additions, -210 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-common/locales/en.json` (+1 -0) 📝 `packages/hoppscotch-common/src/helpers/functional/process-request.ts` (+8 -1) 📝 `packages/hoppscotch-common/src/helpers/graphql/connection.ts` (+4 -0) 📝 `packages/hoppscotch-common/src/helpers/kernel/gql/request.ts` (+4 -0) 📝 `packages/hoppscotch-common/src/helpers/kernel/rest/request.ts` (+6 -2) 📝 `packages/hoppscotch-common/src/kernel/relay.ts` (+8 -1) 📝 `packages/hoppscotch-common/src/newstore/settings.ts` (+2 -0) 📝 `packages/hoppscotch-common/src/pages/settings.vue` (+9 -0) 📝 `packages/hoppscotch-common/src/platform/std/interceptors/proxy.ts` (+2 -1) 📝 `packages/hoppscotch-common/src/platform/std/kernel-interceptors/browser/index.ts` (+1 -1) 📝 `packages/hoppscotch-common/src/platform/std/kernel-interceptors/extension/index.ts` (+11 -8) 📝 `packages/hoppscotch-common/src/platform/std/kernel-interceptors/native/store.ts` (+4 -1) 📝 `packages/hoppscotch-common/src/platform/std/kernel-interceptors/proxy/index.ts` (+6 -3) 📝 `packages/hoppscotch-common/src/services/kernel-interceptor.service.ts` (+2 -1) 📝 `packages/hoppscotch-common/src/services/persistence/validation-schemas/index.ts` (+1 -0) 📝 `packages/hoppscotch-desktop/plugin-workspace/relay/src/interop.rs` (+1 -0) 📝 `packages/hoppscotch-desktop/plugin-workspace/relay/src/request.rs` (+25 -46) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/Cargo.toml` (+1 -1) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/dist-js/index.d.ts` (+2 -1) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/dist-js/index.d.ts.map` (+1 -1) _...and 9 more files_ </details> ### 📄 Description   Closes #2095 <img width="1911" height="972" alt="Redirect" src="https://github.com/user-attachments/assets/b5ab85b5-4e38-43b0-a7db-fc3d365e3bdd" />  This Pull Request introduces a new, user-configurable option to control how Hoppscotch handles HTTP redirects (e.g., 301, 302, 307, 308). It provides the ability to either automatically follow redirects or explicitly disable this behavior, directly addressing the limitations and user requests outlined in Issue #2095. This change offers greater control and visibility into HTTP request flows, especially for debugging and inspecting intermediate responses. ### What's changed This PR implements a globally configurable and per-request controllable "Follow Redirects" capability across all Hoppscotch clients (web, desktop, self-hosted, kernel relay). * **New `FOLLOW_REDIRECTS` Setting:** * A new setting `FOLLOW_REDIRECTS` (default: `true`) has been added to the settings store (`packages/hoppscotch-common/src/newstore/settings.ts`). This ensures backward compatibility, as existing users will inherit the default behavior. * **Per-Request `followRedirects` Option:** * A `followRedirects` boolean option is now propagated through REST, GraphQL, and Kernel relay requests. This option takes precedence over the global setting. * **Unified Redirect Handling:** * The `followRedirects` flag is integrated into the Kernel relay request model (`packages/hoppscotch-kernel/src/relay/v/1.ts`) and is preserved across internal adapters and interceptor layers (web/proxy and native/desktop paths). * This ensures consistent behavior across all platforms and prevents the option from being stripped during request processing. * **Redirect Chain Exposure:** * When `FOLLOW_REDIRECTS` is enabled, the redirect chain (an array of `{ status, location, method?, url? }`) is recorded and surfaced via the existing `redirects` response field, contingent on backend capabilities. * **Explicit Control Over 3xx Responses:** * When `FOLLOW_REDIRECTS` is disabled (either globally or per-request), Hoppscotch will now return the first 3xx response immediately to the UI. This allows users to inspect the `Location` header and other metadata without further redirect resolution. ### Notes to reviewers * **Motivation:** This feature directly addresses the long-standing request in #2095, allowing users to inspect `Location` headers for debugging authentication flows, security analysis, and understanding redirect chains, which was previously impossible due to implicit handling by underlying transport layers. * **Testing:** Manual tests were performed covering REST and GraphQL requests to known redirecting URLs, verifying correct behavior when `followRedirects` is `true` (final response, redirect chain present) and `false` (3xx response returned, `Location` header visible). Parity between desktop and web clients was confirmed. * **Integrity:** Comments (`CRITICAL` markers) have been added to prevent accidental stripping of `request.options` during request cloning or transformation, ensuring `followRedirects` persists through various pipeline stages. * **Out of Scope (for this PR):** * This PR does **not** include UI wiring for the new toggle. A follow-up PR will be needed to expose this setting in the Hoppscotch UI (e.g., in the request advanced settings panel). * No custom maximum redirect limit is introduced; this relies on underlying environment defaults. * No analytics instrumentation is added. * **Edge Cases:** Considered and confirmed that underlying transport layers handle redirect loops (by their own limits), mixed protocol redirects, relative `Location` headers, and method rewriting on 301/302/303. * **Security:** Disabling auto-follow can aid in inspecting potential open redirect vulnerabilities. No changes to credential/cookie handling or protocol upgrades/downgrades beyond existing behavior. * **Follow-Ups:** Future work includes UI implementation, visual exposure of the redirect chain in the response viewer, adding automated tests, potentially surfacing `maxRedirects` as a global setting, and updating documentation. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>