anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Web UI: Basic Auth incompatible with crossorigin attributes on assets #6669

New Issue
Open
opened 2026-02-16 18:04:55 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:04:55 -05:00
Owner
Copy Link
Copy Source

Originally created by @kokucoding on GitHub (Jan 18, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Description

When using OPENCODE_SERVER_PASSWORD to protect the web UI, users get stuck in an authentication loop. The page loads after entering credentials, but assets (JS/CSS) fail to load with 401 Unauthorized.

Root Cause

The HTML page includes assets with crossorigin attribute:

<script type="module" crossorigin src="/assets/index-Qb2EVj9N.js"></script>
<link rel="stylesheet" crossorigin href="/assets/index-z4TcDjz-.css">

When crossorigin is used without crossorigin="use-credentials", browsers make anonymous CORS requests that don't include HTTP Basic Auth credentials. This causes:

  1. Browser loads main HTML page with auth ✅
  2. Browser requests JS/CSS with crossorigin (anonymous) → 401 Unauthorized ❌
  3. Auth popup appears again for each failed asset
  4. Infinite loop - even re-entering credentials doesn't fix it

Environment

  • OpenCode version: 1.1.16
  • Access method: Cloudflare tunnel (remote access)
  • Browser: Chrome/Firefox (both affected)

Steps to Reproduce

  1. Start OpenCode web with password: 
    OPENCODE_SERVER_PASSWORD=secret opencode web --port 4096
  2. Access via browser (especially through reverse proxy/tunnel)
  3. Enter username opencode and password secret
  4. Observe: Page appears but is blank/broken, repeated auth prompts appear

Expected Behavior

After successful authentication, all assets should load without additional auth prompts.

Suggested Fixes

  1. Use crossorigin="use-credentials" on asset tags:

    <script type="module" crossorigin="use-credentials" src="/assets/index.js"></script>

  2. Switch to cookie-based authentication instead of HTTP Basic Auth for web access

  3. Exempt static assets from authentication (JS, CSS, images, fonts)

Workaround

Currently, users must run without OPENCODE_SERVER_PASSWORD when accessing via tunnels/proxies, relying on the obscurity of the tunnel URL for security.

Thank you for the great project! Happy to provide more details or test fixes.

Originally created by @kokucoding on GitHub (Jan 18, 2026). Originally assigned to: @adamdotdevin on GitHub. ## Description When using `OPENCODE_SERVER_PASSWORD` to protect the web UI, users get stuck in an authentication loop. The page loads after entering credentials, but assets (JS/CSS) fail to load with 401 Unauthorized. ## Root Cause The HTML page includes assets with `crossorigin` attribute: ```html <script type="module" crossorigin src="/assets/index-Qb2EVj9N.js"></script> <link rel="stylesheet" crossorigin href="/assets/index-z4TcDjz-.css"> ``` When `crossorigin` is used **without** `crossorigin="use-credentials"`, browsers make anonymous CORS requests that don't include HTTP Basic Auth credentials. This causes: 1. Browser loads main HTML page with auth ✅ 2. Browser requests JS/CSS with `crossorigin` (anonymous) → **401 Unauthorized** ❌ 3. Auth popup appears again for each failed asset 4. Infinite loop - even re-entering credentials doesn't fix it ## Environment - OpenCode version: 1.1.16 - Access method: Cloudflare tunnel (remote access) - Browser: Chrome/Firefox (both affected) ## Steps to Reproduce 1. Start OpenCode web with password: ```bash OPENCODE_SERVER_PASSWORD=secret opencode web --port 4096 ``` 2. Access via browser (especially through reverse proxy/tunnel) 3. Enter username `opencode` and password `secret` 4. Observe: Page appears but is blank/broken, repeated auth prompts appear ## Expected Behavior After successful authentication, all assets should load without additional auth prompts. ## Suggested Fixes 1. **Use `crossorigin="use-credentials"`** on asset tags: ```html <script type="module" crossorigin="use-credentials" src="/assets/index.js"></script> ``` 2. **Switch to cookie-based authentication** instead of HTTP Basic Auth for web access 3. **Exempt static assets from authentication** (JS, CSS, images, fonts) ## Workaround Currently, users must run without `OPENCODE_SERVER_PASSWORD` when accessing via tunnels/proxies, relying on the obscurity of the tunnel URL for security. --- Thank you for the great project! Happy to provide more details or test fixes.
yindo added the web label 2026-02-16 18:04:55 -05:00
yindo commented 2026-02-16 18:04:55 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 18, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #9066: Failing to authenticate into web UI when username or password is set - reports similar authentication loop issue
  • #8676: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set - related to Basic Auth credential handling

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 18, 2026): This issue might be a duplicate of existing issues. Please check: - #9066: Failing to authenticate into web UI when username or password is set - reports similar authentication loop issue - #8676: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set - related to Basic Auth credential handling Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label web
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6669
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?