Per-request Authorization setting does not override Authorization added by default headers plugin

[rocketraman]

Describe the bug I use the Default Headers plugin to workaround https://github.com/Kong/insomnia/issues/1116.

This allows me to set authorization headers at a folder level.

However, a per-request Authorization setting should clearly override the default header set at the folder level, however it does not -- the per-request Authorization settings are completely ignored.

To Reproduce Steps to reproduce the behavior:

1. Install default headers plugin
2. Create a folder and set a default header:

   {
   "DEFAULT_HEADERS": {
   "Authorization": "Bearer {{ _.token }}"
   }
   }

3. Create a request inside that folder, and add a Bearer authorization with a different token.
4. Make a request -- the default header auth token is sent, not the request auth token.

Expected behavior I want the "default headers" to be just that: defaults. In other words, they are used only when they are not already explicitly set at a per-request level.

Desktop (please complete the following information):

• OS: Linux
• Installation Method: Flatpak
• App Version: 2021.3.0

Additional context We really really need a proper solution to re-using authorization settings.

[filfreire]

Hi @rocketraman, thank you for reporting this!

I'm able to reproduce this as of 2022.3.0.

I think this could be slightly different and easier "fix" than what is related with #1116 and #3694. For instance, as of now if folks define both Authorization and on Headers also define an Authorization header, the Authorization header takes precedence over both the Authorization and the DEFAULT_HEADERS set with our Default headers plugin.

It could be just a matter of fixing on the plugin the order by which each overrides each other: 1) DEFAULT_HEADERS (via plugin) 2) Authorization setup 3) Authorization header setup on Headers

[adamhp]

Would very much like to see this implemented.

A quick work-around for others: use directory specific environments. I have a 'Pre-Authentication' and 'Post-Authentication' directory.

Pre-Auth has no DEFAULT_HEADERS, but Post-Authentication uses the Response token from my Login call.