fix: OAuth2 Basic Auth header encoding for special characters by sanjaikumar-bruno · Pull Request #6263 · usebruno/bruno

sanjaikumar-bruno · 2025-12-02T06:07:07Z

Removed URI encoding of client ID and secret before Base64 encoding. The credentials are now Base64-encoded directly as clientId:clientSecret.

…y URI encoding

coderabbitai · 2025-12-02T06:07:17Z

Walkthrough

Two OAuth2 utility modules are updated to remove URL-encoding of client credentials before Base64 encoding in Basic Authentication headers. The clientId and clientSecret are now directly Base64 encoded across multiple OAuth2 authorization flows (authorizationCode, clientCredentials, passwordCredentials, refreshToken, and password grant paths).

Changes

Cohort / File(s)	Summary
OAuth2 Basic Auth Header Construction `packages/bruno-electron/src/utils/oauth2.js`, `packages/bruno-requests/src/auth/oauth2-helper.ts`	Removes `encodeURIComponent()` wrapper from clientId and clientSecret during Basic Authentication header formation. Credentials are now directly concatenated and Base64 encoded in authorization flows: authorizationCode, clientCredentials, passwordCredentials, refreshToken (Electron), and client_credentials, password (requests helper).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Verify consistency of the encoding change across all four OAuth2 flow methods in the Electron module
Confirm both token fetch paths in the requests helper apply the same logic
Validate that removing URL-encoding aligns with OAuth2 spec for Basic Authentication (RFC 6749)

Poem

🔐 No more double-wrapping credentials tight,
Base64 speaks direct—clean and right,
OAuth2 flows now skip the encode dance,
ClientId and Secret get their rightful chance! 🎭

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: removing URL-encoding from OAuth2 Basic Auth header credential construction.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 4

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between dd72ee5 and 08399c5.

📒 Files selected for processing (2)

packages/bruno-electron/src/utils/oauth2.js (4 hunks)
packages/bruno-requests/src/auth/oauth2-helper.ts (2 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)

GitHub Check: Playwright E2E Tests
GitHub Check: Unit Tests
GitHub Check: CLI Tests
GitHub Check: SSL Tests - Windows
GitHub Check: SSL Tests - macOS
GitHub Check: SSL Tests - Linux

🔇 Additional comments (4)

packages/bruno-requests/src/auth/oauth2-helper.ts (2)

148-148: Encoding fix correctly implements RFC 2617 Basic Authentication.

Removing encodeURIComponent before Base64 encoding is the correct implementation. Per RFC 2617, Basic Authentication credentials should be formatted as base64(clientId:clientSecret) without URL encoding.

148-148: Add validation for clientSecret when using basic_auth_header credentials placement.

The code uses a non-null assertion (clientSecret!) without validating that clientSecret is defined. Since OAuth2Config declares clientSecret as optional, this could cause a runtime error. Add an explicit check before constructing the Authorization header, or verify that all callers guarantee clientSecret is defined when credentialsPlacement is 'basic_auth_header'.

packages/bruno-electron/src/utils/oauth2.js (2)

453-455: Good validation pattern for clientSecret.

This flow correctly validates that clientSecret exists and is not empty before constructing the Basic Auth header. The encoding fix is correct per RFC 2617.

600-602: Proper validation and correct encoding.

Like the client credentials flow, this correctly validates clientSecret before use. The encoding fix aligns with RFC 2617 Basic Authentication standards.

packages/bruno-electron/src/utils/oauth2.js

packages/bruno-requests/src/auth/oauth2-helper.ts

bijin-bruno · 2025-12-02T07:21:53Z

Unit tests to be added in the PR #6186 related to current changes
cc - @abhishek-bruno

…y URI encoding (usebruno#6263)

fix: update OAuth2 authorization header encoding to remove unnecessar…

08399c5

…y URI encoding

sanjaikumar-bruno requested review from bijin-bruno, helloanoop, lohit-bruno and naman-bruno as code owners December 2, 2025 06:07

pull-request-size bot added the size/S label Dec 2, 2025

coderabbitai bot reviewed Dec 2, 2025

View reviewed changes

packages/bruno-electron/src/utils/oauth2.js Show resolved Hide resolved

packages/bruno-electron/src/utils/oauth2.js Show resolved Hide resolved

packages/bruno-requests/src/auth/oauth2-helper.ts Show resolved Hide resolved

bijin-bruno approved these changes Dec 2, 2025

View reviewed changes

bijin-bruno merged commit 9d6486b into usebruno:main Dec 2, 2025
8 checks passed

naman-bruno pushed a commit to naman-bruno/bruno that referenced this pull request Dec 2, 2025

fix: update OAuth2 authorization header encoding to remove unnecessar…

7476192

…y URI encoding (usebruno#6263)

coderabbitai bot mentioned this pull request Dec 4, 2025

fix: gRPC oauth2 call is not taking ssl cert and proxy config #6313

Merged

6 tasks

This was referenced Dec 9, 2025

client-id and client-secret always get URL Encoded in Oauth Client Credentials flow #5522

Closed

Base64 encoding in OAuth2 Basic header is incorrect #5512

Closed

coderabbitai bot mentioned this pull request Dec 22, 2025

WSSE requests are generating too long digests #6482

Open

5 tasks

coderabbitai bot mentioned this pull request Jan 12, 2026

fix: handle optional clientSecret in OAuth2 authorization header #6186

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: OAuth2 Basic Auth header encoding for special characters#6263

fix: OAuth2 Basic Auth header encoding for special characters#6263
bijin-bruno merged 1 commit intousebruno:mainfrom
sanjaikumar-bruno:fix/oauth2-basic-auth-header

sanjaikumar-bruno commented Dec 2, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bijin-bruno commented Dec 2, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

sanjaikumar-bruno commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Pre-merge checks and finishing touches

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bijin-bruno commented Dec 2, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sanjaikumar-bruno commented Dec 2, 2025 •

edited

Loading

coderabbitai bot commented Dec 2, 2025 •

edited

Loading