Health check password protected #12805

Activity

1. pando85

   added

   bugSomething isn't workingSomething isn't working

   on Feb 9, 2026
2. github-actions

   assigned

   thdxr

   on Feb 9, 2026
3. github-actions commented on Feb 9, 2026

   

   github-actionsBot

   on Feb 9, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • OPENCODE_SERVER_PASSWORD in env prevents user from working in TUI #8173: OPENCODE_SERVER_PASSWORD prevents TUI from working (Unauthorized error)
   • Web UI: Basic Auth incompatible with crossorigin attributes on assets #9206: Web UI: Basic Auth incompatible with crossorigin attributes on assets
   • Failing to authenticate into web UI when username or password is set #9066: Failing to authenticate into web UI when password is set
   • fix: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop) #8676: Plugin client returns 401 when OPENCODE_SERVER_PASSWORD is set
   • [BUG] Plugin client missing Authorization header when OPENCODE_SERVER_PASSWORD is set #9706: Plugin client missing Authorization header when password is set
   • PWA failed because HTTP basic auth block static assets #12447: PWA failed because HTTP basic auth blocks static assets
   • Basic Auth breaks the CORS support #10047: Basic Auth breaks CORS support
   • Cannot 'attach' to an opencode server with a password #9011: Cannot attach to opencode server with a password

   All these issues stem from the same root cause: HTTP Basic Auth middleware is being applied too broadly and blocks endpoints/resources that shouldn't require authentication (health checks, static assets, CORS preflight requests, plugin API calls, etc.)

   Feel free to ignore if this specific case differs from those listed above.
4. j4ckstraw commented on Mar 16, 2026

   

   j4ckstraw

   on Mar 16, 2026

   More actions

   +1

   👍React with 👍1Reacted by M2kar
5. m2kar commented on Mar 20, 2026

   

   m2kar

   on Mar 20, 2026

   More actions

   +1
6. levmichael3 commented on Apr 13, 2026

   

   levmichael3

   on Apr 13, 2026

   More actions

   We're deploying OpenCode to EKS with an ALB ingress. The health check (/global/health) being password-protected blocks ALB health checks - the load balancer can't authenticate.

   Workaround suggested: Use nginx sidecar for auth, keeping OpenCode unauthenticated internally. This pattern is common in k8s deployments:

   • Nginx handles external auth + TLS termination
   • OpenCode runs without credentials inside the cluster

   Is there appetite for a PR implementing nginx sidecar auth example in the Helm chart? Or any alternative approaches you'd recommend?
7. iv0 commented on Apr 19, 2026

   

   iv0

   on Apr 19, 2026

   More actions

   +1
8. thdxr

   assigned

   kitlangton

   and unassigned

   thdxr

   on Apr 26, 2026
9. thdxr

   removed

   bugSomething isn't workingSomething isn't working

   on May 3, 2026
10. github-actions commented on Jul 3, 2026

    

    github-actionsBot

    on Jul 3, 2026 – with GitHub Actions

    Contributor

    More actions

    To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
11. github-actions

    closed this as not plannedon Jul 3, 2026