Authorization token not being added to request headers
- Dominant language
- TypeScript
- Stars
- 40k
- Forks
- 2.4k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 61
Description
**Describe the bug**
When attempting to query a GraphQL API I have locally with OAuth2 Implicit credentials, the Authorization header is not being added to the request. I am able to get the Acces Token to populate and if I manually add an Authorization header with that token (prefixed with "Bearer ") it works just fine. However, this requires needing to copy and paste the token into the headers section. From the documentation, it looks like the request should automatically add the header to my request without this additional step.
From my about:
Version: Insomnia Core 2020.4.2
Release date: 10/21/2020
OS: Windows_NT x64 10.0.19041
Electron: 9.1.1
Node: 12.14.1
V8: 8.3.110.13-electron.0
Architecture: x64
node-libcurl: libcurl/7.69.1-DEV OpenSSL/1.1.1d zlib/1.2.11 WinIDN libssh2/1.9.0_DEV nghttp2/1.40.0
**To Reproduce**
1. Create new request, set auth type to "OAuth2" and Grant type to "Implicit". Fill out AuthorizationURL, Client Id, Redirect URL, Response Type = Access Token, Scope, and State (empty) as values.
2. Optionally set Header Prefix (I tried with it empty and with "Bearer") and Audience (wasn't needed for me).
3. Click Fetch Tokens and log in to your OAuth2 Provider. The Access Token should populate.
4. Ensure the "Header" tab does not include an "Authorization" header
5. Send the request.
6. Note that, if the endpoint required authentication, it fails.
7. Check the Timeline tab on the response - note that the Request header information does NOT include Authorization.
**Expected behavior**
I expect when the Authorization tab is properly able to create a token, or has already received one, that that Authorization header will be added to the outbound request when sent.
**Screenshots**



**Desktop (please complete the following information):**
- OS: Windows 10 Enterprise Version 2004 (19041.572)
- Installation Method: Insomnia.Core-2020.4.2.exe downloaded from https://insomnia.rest/download/#windows
- App Version v2020.4.2
**Additional context**
I've had other developers at my company have the same issue with Insomnia on their machines, and they also had to copy and paste the token into the headers. I've also tried Authorization Code and it's the same - the tab can retrieve a token, but it is not added to the request at all. I also copied the token and tried using Bearer with the same results.
Contributor guide
Research direction
Reproduce the OAuth2 Implicit and Authorization Code flows described in the issue, then inspect the Timeline tab to compare the outbound request headers with the retrieved token. Trace the request path responsible for applying authorization and verify completion when a fetched token automatically appears as a Bearer Authorization header.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, typescript
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100