4
[Usability] Stale OAuth access token used after switching environments
Source: Kong/insomnia#3564 · opened by @nathanwaldman
Overview
• Insomnia Version: 5.1.0
• Operating System: MacOS 10.11.3
• Summary: Switching environments retains OAuth 2 refresh and access tokens when they may no longer be valid.
How To Reproduce
1. Create two separate environments "non-prod" and "prod".
2. In both environments define an oauthhost variable and give it two separate values representing two separate oauth hosts whose tokens are not exchangeable between the two oauth systems.
3. Create a route and configure it with OAuth 2 security, grant type "Resource Owner Password Credentials" and use the oauthhost variable when defining the Access Token Url.
4. Send the request and see that it fetches tokens and successfully calls the endpoint.
5. Change environments.
6. Send the request. Note that it does not update the access or refresh tokens and the result is a 401 Unauthorized.
• Insomnia Version: 5.1.0
• Operating System: MacOS 10.11.3
• Summary: Switching environments retains OAuth 2 refresh and access tokens when they may no longer be valid.
How To Reproduce
1. Create two separate environments "non-prod" and "prod".
2. In both environments define an oauthhost variable and give it two separate values representing two separate oauth hosts whose tokens are not exchangeable between the two oauth systems.
3. Create a route and configure it with OAuth 2 security, grant type "Resource Owner Password Credentials" and use the oauthhost variable when defining the Access Token Url.
4. Send the request and see that it fetches tokens and successfully calls the endpoint.
5. Change environments.
6. Send the request. Note that it does not update the access or refresh tokens and the result is a 401 Unauthorized.
No pledges yet. Be the first to back this.
Comments
Similar requests
Please provide one more environment level for private environments
2 votes · 0 comments
Add button to copy fetched tokens
1 vote · 0 comments
Add keyboard shortcuts to switch environments
1 vote · 0 comments
Feature request: export selected environments
3 votes · 0 comments
Allow access to OAuth 2.0 response from parents
1 vote · 0 comments
No comments yet.