anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Add CORS middleware for Firefox localhost development compatibility #535

New Issue
Closed
opened 2026-02-16 17:27:13 -05:00 by yindo · 2 comments
yindo commented 2026-02-16 17:27:13 -05:00
Owner
Copy Link
Copy Source

Originally created by @chris-tse on GitHub (Jul 7, 2025).

Originally assigned to: @thdxr on GitHub.

Add CORS support for localhost development in Firefox

Firefox enforces stricter CORS policies than other browsers, even for localhost origins. The opencode server currently has no CORS middleware configured, causing Firefox to block cross-origin requests

Current Behavior

  • Chrome/Safari: Requests from localhost:5173 → localhost:4096 work fine
  • Firefox/Zen: Same requests fail with CORS error 
    Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://127.0.0.1:4096/session. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 404.

Proposed Solution

Add CORS middleware to the Hono server with localhost-specific configuration.

import { cors } from "hono/cors"

function app() {
  const app = new Hono()

  const result = app
    .onError((err, c) => {
      // ... existing error handling
    })
    .use(
      "*",
      cors({
        origin: (origin) => {
          // Allow localhost origins on any port for development
          const localhostPattern = /^https?:\/\/localhost(:\d+)?$/
          const localhostIPPattern = /^https?:\/\/127\.0\.0\.1(:\d+)?$/

          if (
            localhostPattern.test(origin) ||
            localhostIPPattern.test(origin)
          ) {
            return origin
          }

          return null // Reject other origins
        },
        allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
        allowHeaders: ["Content-Type", "Authorization", "X-Requested-With"],
        exposeHeaders: ["Content-Length", "X-Request-ID"],
        credentials: true,
        maxAge: 86400, // 24 hours for development
      }),
    )
    .use(async (c, next) => {
      // ... existing logging middleware
    })
  // ... rest of route definitions

  return result
}
Originally created by @chris-tse on GitHub (Jul 7, 2025). Originally assigned to: @thdxr on GitHub. # Add CORS support for localhost development in Firefox Firefox enforces stricter CORS policies than other browsers, even for localhost origins. The opencode server currently has no CORS middleware configured, causing Firefox to block cross-origin requests ### Current Behavior - Chrome/Safari: Requests from `localhost:5173` → `localhost:4096` work fine - Firefox/Zen: Same requests fail with CORS error ``` Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://127.0.0.1:4096/session. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 404. ``` ## Proposed Solution Add CORS middleware to the Hono server with localhost-specific configuration. ```typescript import { cors } from "hono/cors" function app() { const app = new Hono() const result = app .onError((err, c) => { // ... existing error handling }) .use( "*", cors({ origin: (origin) => { // Allow localhost origins on any port for development const localhostPattern = /^https?:\/\/localhost(:\d+)?$/ const localhostIPPattern = /^https?:\/\/127\.0\.0\.1(:\d+)?$/ if ( localhostPattern.test(origin) || localhostIPPattern.test(origin) ) { return origin } return null // Reject other origins }, allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"], allowHeaders: ["Content-Type", "Authorization", "X-Requested-With"], exposeHeaders: ["Content-Length", "X-Request-ID"], credentials: true, maxAge: 86400, // 24 hours for development }), ) .use(async (c, next) => { // ... existing logging middleware }) // ... rest of route definitions return result } ```
yindo closed this issue 2026-02-16 17:27:13 -05:00
yindo commented 2026-02-16 17:27:13 -05:00
Author
Owner
Copy Link
Copy Source

@chris-tse commented on GitHub (Jul 12, 2025):

Actually, not sure if it was a flaw when I was testing, but I'm actually now seeing the CORS error happen in Chrome/Safari too now.

For context, I'm messing around with building a web UI using the server endpoints, and for now I've been getting around by just building the latest version of dev branch with this change to run locally for now

Maybe i should just do this in a fork serving it straight from root route of 4096

@chris-tse commented on GitHub (Jul 12, 2025): Actually, not sure if it was a flaw when I was testing, but I'm actually now seeing the CORS error happen in Chrome/Safari too now. For context, I'm messing around with building a web UI using the server endpoints, and for now I've been getting around by just building the latest version of dev branch with this change to run locally for now <sub>Maybe i should just do this in a fork serving it straight from root route of 4096</sub>
yindo commented 2026-02-16 17:27:13 -05:00
Author
Owner
Copy Link
Copy Source

@chris-tse commented on GitHub (Jul 20, 2025):

With the introduction of the various SDKs, this issue isn't really going to be a thing with my use case anymore. Going to close for now.

@chris-tse commented on GitHub (Jul 20, 2025): With the introduction of the various SDKs, this issue isn't really going to be a thing with my use case anymore. Going to close for now.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#535
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?