Kong / Kong/insomnia

HAWK Authentication uses wrong content type for graphql requests

Open
#4,855 3 comments 0 reactions 0 assignees View on GitHub
B-bug N-author-input N-investigation S-unverified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

### Expected Behavior

Authentication process should pass on server.
Insomnia should use `content-type` header for payload hash computation

### Actual Behavior

Authentication process fails due to wrong content type used by insomnia for hash computation

### Reproduction Steps

1) Make a GraphQL Request with HAWK Authentication
2) Obviously it will use by default `content-type: application/json` in headers section
3) Send a request
4) Authentication fails even though HAWK's auth id and key are correct

I've debugged it in dev tools and turned out that insomnia ignores `content-type` header and uses `body.mimeType` instead which will be `application/graphql` in case of graphql requests.

Repository: https://github.com/wookieb/insomnia-issue-4855

### Is there an existing issue for this?

- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.

### Additional Information

You're using `@hapi/hawk`but this is no longer maintained. You should upgrade to `hawk`

I wanted to fix it on my own but apparently this part of code is nor available in this repository?

### Insomnia Version

2022.3.0

### What operating system are you using?

macOS

### Operating System Version

OSX 12.4

### Installation method

insomnia.rest

### Last Known Working Insomnia version

_No response_

Contributor guide

Open the contributing guide

Research direction

No source file or test is named in the issue. Start by locating the HAWK authentication request-signing entry point and the GraphQL request body/content-type handling, then reproduce the failure with a GraphQL request that sends content-type: application/json. Done means the signing process uses the request header consistently and authentication succeeds with the reported request.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, typescript
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.