fix(playground): request headers win over the Auth tab when both set the same header - #80
Draft
sundram-bruno wants to merge 9 commits into
Draft
sundram-bruno wants to merge 9 commits into
sundram-bruno wants to merge 9 commits into
Conversation
…the same header A pre-request script that set its own Authorization header had it overwritten by the bearer, basic or api key auth configured on the request. The executor now skips the configured auth header when the request already carries one with the same name, matching the desktop app where the script runs after auth is applied.
|
…cript headers, as on desktop The previous commit let any existing header beat the Auth tab, which also let a Headers tab row win. The runner now records which header names the pre-request script wrote, and the executor only yields bearer and api key auth to those. Basic auth always overwrites, since desktop encodes it after the script runs.
… cases Each remaining test maps to one acceptance criterion or one branch of the precedence code. Removed cases either repeated a covered branch at another layer or pinned behaviour this change does not own.
…s no longer skip auth The list of headers written by the pre-request script is now reset by the runner on every run, so a collection cannot pre-declare it and suppress the configured auth. The snapshot compares name and value pairs instead of a name keyed map, so two enabled rows with the same name are not mistaken for a script write. Helper names follow the verb-first convention of the folder.
…ce specs Adds the missing e2e for a script header beating api key auth, restores the basic auth over Headers tab case, folds a casing duplicate into its sibling, types the test header rows, and moves the users request wait onto the response pane component so specs stop repeating the URL glob.
sundram-bruno
marked this pull request as draft
September 15, 2026 08:36
req.setHeader and req.headerList.upsert updated only the first enabled row with a matching name, while the executor sends the last row. With duplicate Headers tab rows the script value never reached the wire, and once the script owned the name the Auth tab was skipped too, so neither value went out. Both writes now drop the other enabled duplicates, matching the single header object on desktop.
Both wrote a header the same way, so setHeader now calls upsert and the duplicate row handling lives in one place.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JIRA: BRU-4487
Problem
In the docs playground, a pre-request script that sets its own
Authorizationheader loses to the Auth tab. The request executor copies the request headers first, then writes the configured bearer, basic or api key header on top, unconditionally. So a collection whose script signs its own token, or fetches one from a login endpoint, works in the Bruno desktop app but sends the wrong credential when published as docs.Desktop applies the Auth tab first and runs the script after, so whatever the script writes is what goes on the wire.
Solution
Playground now skips the configured auth header when the pre-request script set a header with the same name. The check is case-insensitive, so authorization from a script matches too. A header from the Headers tab is still overwritten by the Auth tab, as before and as on desktop.
Basic auth in desktop still gets preference over script as per parity with desktop app.