[PR #5948] fix(auth): allow refresh token extraction from Authorization header f… #5429

New issue

Open

opened 2026-03-17 02:52:34 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:52:34 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5948
Author: @sahilkhan09k
Created: 3/5/2026
Status: 🔄 Open

Base: main ← Head: fix-refresh-token-header-support

📝 Commits (4)

f610e33 fix(auth): allow refresh token extraction from Authorization header for desktop client
407cfac (auth) fix : Updated the split to slice
47f2202 (auth) fix : Changed the non-ascii to ascii character
3bd64b5 (auth) fix : Changed the function to be more optimal

📊 Changes

1 file changed (+33 additions, -9 deletions)

View changed files

📝 packages/hoppscotch-backend/src/auth/strategies/rt-jwt.strategy.ts (+33 -9)

📄 Description

Closes #5635

This PR fixes an issue where the desktop client cannot refresh authentication tokens after the access token expires. The backend currently only extracts the refresh token from cookies, while the desktop client sends it through the Authorization Bearer header. As a result, the refresh request fails with COOKIES_NOT_FOUND, forcing users to repeatedly log in.

What's changed

Updated the refresh token extraction logic in RTJwtStrategy.

Added support for extracting the refresh token from the Authorization: Bearer header.

Kept the existing cookie-based extraction to ensure the web client continues to work as before.

Added a fallback mechanism so the backend now accepts refresh tokens from:

refresh_token cookie (web client)

Authorization header (desktop client)

Notes to reviewers

The desktop client already sends the refresh token using the Authorization header during refresh requests. However, the backend strategy only checked for the token in cookies, causing refresh requests to fail with COOKIES_NOT_FOUND.

This change preserves the current cookie-based flow used by the web application while adding compatibility with the desktop client by supporting header-based token extraction.

Summary by cubic

Allow refresh tokens to be read from the Authorization: Bearer header, fixing desktop token refresh failures. Keeps the cookie flow for web and resolves #5635.

Bug Fixes
- RTJwtStrategy checks the refresh_token cookie first, then parses Authorization: Bearer from string or array headers; standardized ASCII error message.
- Prevents COOKIES_NOT_FOUND on desktop and avoids forced re-logins after access token expiry.

^{Written for commit 3bd64b5066. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5948 **Author:** [@sahilkhan09k](https://github.com/sahilkhan09k) **Created:** 3/5/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix-refresh-token-header-support` --- ### 📝 Commits (4) - [`f610e33`](https://github.com/hoppscotch/hoppscotch/commit/f610e33a98adba4cd38cb193557a02d1366545d0) fix(auth): allow refresh token extraction from Authorization header for desktop client - [`407cfac`](https://github.com/hoppscotch/hoppscotch/commit/407cfac2a7e3ac171aa7e698ca799142d8bcec7f) (auth) fix : Updated the split to slice - [`47f2202`](https://github.com/hoppscotch/hoppscotch/commit/47f220236951c41c35df4a7e0dce2bb9ebc6b5b7) (auth) fix : Changed the non-ascii to ascii character - [`3bd64b5`](https://github.com/hoppscotch/hoppscotch/commit/3bd64b5066003ab9630b70407558dbf1c05a5868) (auth) fix : Changed the function to be more optimal ### 📊 Changes **1 file changed** (+33 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-backend/src/auth/strategies/rt-jwt.strategy.ts` (+33 -9) </details> ### 📄 Description Closes #5635 This PR fixes an issue where the desktop client cannot refresh authentication tokens after the access token expires. The backend currently only extracts the refresh token from cookies, while the desktop client sends it through the Authorization Bearer header. As a result, the refresh request fails with COOKIES_NOT_FOUND, forcing users to repeatedly log in. What's changed Updated the refresh token extraction logic in RTJwtStrategy. Added support for extracting the refresh token from the Authorization: Bearer <token> header. Kept the existing cookie-based extraction to ensure the web client continues to work as before. Added a fallback mechanism so the backend now accepts refresh tokens from: refresh_token cookie (web client) Authorization header (desktop client) Notes to reviewers The desktop client already sends the refresh token using the Authorization header during refresh requests. However, the backend strategy only checked for the token in cookies, causing refresh requests to fail with COOKIES_NOT_FOUND. This change preserves the current cookie-based flow used by the web application while adding compatibility with the desktop client by supporting header-based token extraction.  --- ## Summary by cubic Allow refresh tokens to be read from the Authorization: Bearer header, fixing desktop token refresh failures. Keeps the cookie flow for web and resolves #5635. - **Bug Fixes** - RTJwtStrategy checks the refresh_token cookie first, then parses Authorization: Bearer from string or array headers; standardized ASCII error message. - Prevents COOKIES_NOT_FOUND on desktop and avoids forced re-logins after access token expiry. <sup>Written for commit 3bd64b5066003ab9630b70407558dbf1c05a5868. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>