Kong / Kong/insomnia

Oauth 1.0 signature seems to be invalid with array-type query params

Open
#4,407 3 comments 0 reactions 0 assignees View on GitHub
B-bug N-author-input S-unverified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

### Expected Behavior

Sending a `GET` request with array-type query parameters should succeed with Oauth 1.0 authorization. Example:

![image](https://user-images.githubusercontent.com/1480914/151030608-083b5922-fcb1-4b9e-91a9-2ea652bb4ddf.png)

Query params:

```
?fields%5Bledger%5D=id,tenant&fields%5Btenant%5D=id,preferences
```

### Actual Behavior

The specific (private) API I am using responds back with a 401 code (only in Insomnia) with the following message:

```
Invalid OAuth Request
```

My first thought was there might be a bug on the API side, but I tested this exact request in both Postman and HTTPie (using [httpie-oauth](https://github.com/httpie/httpie-oauth)) and both requests succeeded.

Requests in Insomnia work as normal with regular text parameters.

Here is the resulting authorization header from Postman:

```
OAuth oauth_consumer_key="[redacted key]",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1643126089",oauth_nonce="kCapbHcTN1S",oauth_version="1.0",oauth_signature="M04BE%2FaScc4iMtj5yLfGUUFNVlk%3D"
```

Here is the one from HTTPie:

```
OAuth oauth_nonce="181813793199661706071643129935", oauth_timestamp="1643129935", oauth_version="1.0", oauth_signature_method="HMAC-SHA1", oauth_consumer_key="[redacted key]", oauth_signature="K0yGpYBR8k1H4OH1Ob6f%2FVSwws8%3D"
```

Here is one from Insomnia:

```
OAuth oauth_consumer_key="[redacted key]", oauth_nonce="FsPvpZh5KmiEOQRCq1SDv2Fl1w9Ayjcu", oauth_signature="wmVFuppdTwC5uvP8GNeWZD%2FSb94%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1643127628", oauth_version="1.0"
```

Postman authentication settings:

![image](https://user-images.githubusercontent.com/1480914/151023843-bf5f82df-28fe-4f5e-9e82-be0211574182.png)

Insomnia authentication settings:

![image](https://user-images.githubusercontent.com/1480914/151023909-51b89205-bdb8-4e47-a93b-6303c5ab9fa6.png)

### Reproduction Steps

_No response_

### Is there an existing issue for this?

- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.

### Additional Information

_No response_

### Insomnia Version

2021.7.2

### What operating system are you using?

Windows

### Operating System Version

Windows 11 Pro version 21H2

### Installation method

download from insomnia.rest

### Last Known Working Insomnia version

_No response_

Contributor guide

Open the contributing guide

Research direction

No source file or test is identified in the issue. Start by reproducing the GET request with array-type query parameters in Insomnia 2021.7.2 and compare its OAuth 1.0 signature with Postman and HTTPie, then trace the OAuth signing entry point and query-parameter normalization. Done means the request authenticates successfully and produces a compatible signature.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.