anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Health check password protected #8893

New Issue
Open
opened 2026-02-16 18:11:06 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:11:06 -05:00
Owner
Copy Link
Copy Source

Originally created by @pando85 on GitHub (Feb 9, 2026).

Originally assigned to: @thdxr on GitHub.

Description

When running opencode serve with OPENCODE_SERVER_PASSWORD the health check endpoint (/global/health) needs authentication.
That's not expected and doesn't follow standard practices in the industry.

I could help fix the issue if you are interested in it.

Plugins

No response

OpenCode version

No response

Steps to reproduce

  1. Deploy opencode serve with OPENCODE_SERVER_PASSWORD envar value
  2. Check endpoint /global/health, you will require basic auth.

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @pando85 on GitHub (Feb 9, 2026). Originally assigned to: @thdxr on GitHub. ### Description When running `opencode serve` with `OPENCODE_SERVER_PASSWORD` the health check endpoint (`/global/health`) needs authentication. That's not expected and doesn't follow standard practices in the industry. I could help fix the issue if you are interested in it. ### Plugins _No response_ ### OpenCode version _No response_ ### Steps to reproduce 1. Deploy `opencode serve` with `OPENCODE_SERVER_PASSWORD` envar value 2. Check endpoint `/global/health`, you will require basic auth. ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the bug label 2026-02-16 18:11:06 -05:00
yindo commented 2026-02-16 18:11:06 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 9, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #8173: OPENCODE_SERVER_PASSWORD prevents TUI from working (Unauthorized error)
  • #9206: Web UI: Basic Auth incompatible with crossorigin attributes on assets
  • #9066: Failing to authenticate into web UI when password is set
  • #8676: Plugin client returns 401 when OPENCODE_SERVER_PASSWORD is set
  • #9706: Plugin client missing Authorization header when password is set
  • #12447: PWA failed because HTTP basic auth blocks static assets
  • #10047: Basic Auth breaks CORS support
  • #9011: Cannot attach to opencode server with a password

All these issues stem from the same root cause: HTTP Basic Auth middleware is being applied too broadly and blocks endpoints/resources that shouldn't require authentication (health checks, static assets, CORS preflight requests, plugin API calls, etc.)

Feel free to ignore if this specific case differs from those listed above.

@github-actions[bot] commented on GitHub (Feb 9, 2026): This issue might be a duplicate of existing issues. Please check: - #8173: OPENCODE_SERVER_PASSWORD prevents TUI from working (Unauthorized error) - #9206: Web UI: Basic Auth incompatible with crossorigin attributes on assets - #9066: Failing to authenticate into web UI when password is set - #8676: Plugin client returns 401 when OPENCODE_SERVER_PASSWORD is set - #9706: Plugin client missing Authorization header when password is set - #12447: PWA failed because HTTP basic auth blocks static assets - #10047: Basic Auth breaks CORS support - #9011: Cannot attach to opencode server with a password All these issues stem from the same root cause: **HTTP Basic Auth middleware is being applied too broadly and blocks endpoints/resources that shouldn't require authentication** (health checks, static assets, CORS preflight requests, plugin API calls, etc.) Feel free to ignore if this specific case differs from those listed above.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#8893
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?