Oauth 1.0 signature seems to be invalid with array-type query params
- Dominant language
- TypeScript
- Stars
- 40k
- Forks
- 2.4k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 61
Description
### Expected Behavior
Sending a `GET` request with array-type query parameters should succeed with Oauth 1.0 authorization. Example:

Query params:
```
?fields%5Bledger%5D=id,tenant&fields%5Btenant%5D=id,preferences
```
### Actual Behavior
The specific (private) API I am using responds back with a 401 code (only in Insomnia) with the following message:
```
Invalid OAuth Request
```
My first thought was there might be a bug on the API side, but I tested this exact request in both Postman and HTTPie (using [httpie-oauth](https://github.com/httpie/httpie-oauth)) and both requests succeeded.
Requests in Insomnia work as normal with regular text parameters.
Here is the resulting authorization header from Postman:
```
OAuth oauth_consumer_key="[redacted key]",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1643126089",oauth_nonce="kCapbHcTN1S",oauth_version="1.0",oauth_signature="M04BE%2FaScc4iMtj5yLfGUUFNVlk%3D"
```
Here is the one from HTTPie:
```
OAuth oauth_nonce="181813793199661706071643129935", oauth_timestamp="1643129935", oauth_version="1.0", oauth_signature_method="HMAC-SHA1", oauth_consumer_key="[redacted key]", oauth_signature="K0yGpYBR8k1H4OH1Ob6f%2FVSwws8%3D"
```
Here is one from Insomnia:
```
OAuth oauth_consumer_key="[redacted key]", oauth_nonce="FsPvpZh5KmiEOQRCq1SDv2Fl1w9Ayjcu", oauth_signature="wmVFuppdTwC5uvP8GNeWZD%2FSb94%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1643127628", oauth_version="1.0"
```
Postman authentication settings:

Insomnia authentication settings:

### Reproduction Steps
_No response_
### Is there an existing issue for this?
- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.
### Additional Information
_No response_
### Insomnia Version
2021.7.2
### What operating system are you using?
Windows
### Operating System Version
Windows 11 Pro version 21H2
### Installation method
download from insomnia.rest
### Last Known Working Insomnia version
_No response_
Contributor guide
Research direction
No source file or test is identified in the issue. Start by reproducing the GET request with array-type query parameters in Insomnia 2021.7.2 and compare its OAuth 1.0 signature with Postman and HTTPie, then trace the OAuth signing entry point and query-parameter normalization. Done means the request authenticates successfully and produces a compatible signature.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100