Repository navigation
[Bug][Web] Basic auth causes 401 on /site.webmanifest and /global/event, then crashes with PasteTypeError #16493
Closed as not planned
Description
Description
When running OpenCode Web with server auth enabled (OPENCODE_SERVER_USERNAME / OPENCODE_SERVER_PASSWORD), the app partially loads, but two requests fail with 401:
GET /site.webmanifest->401 UnauthorizedGET /global/event-> fetch failed / unauthorized
After that, the UI crashes with:
PasteTypeError: Cannot read properties of undefined (reading 'length')
This looks like a web auth inconsistency + missing frontend guard after unauthorized event/manifest fetch.
Plugins
No response
OpenCode version
1.2.20
Steps to reproduce
- On Windows, set env vars for web auth:
OPENCODE_SERVER_USERNAME=<redacted>OPENCODE_SERVER_PASSWORD=<redacted>
- Start web mode:
opencode web - Open browser to local URL (e.g.
http://127.0.0.1:<port>) - Observe console/network errors and then frontend crash.
Screenshot and/or share link
Console snippets (sanitized):
GET http://127.0.0.1:40960/site.webmanifest 401 (Unauthorized)Fetch failed loading: GET "http://127.0.0.1:40960/global/event"PasteTypeError: Cannot read properties of undefined (reading 'length')
atassets/session-*.js
atassets/index-*.js
Operating System
Windows
Terminal
PowerShell
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Mar 7, 2026
This issue might be a duplicate of existing issues. Please check:
/site.webmanifest(same root cause - static assets not exempted from auth middleware)If your issue is distinct, please clarify what differs from the above.
rocordov commentedon May 5, 2026
Workaround: we found that running a second
opencode webinstance on a different port (for session isolation) triggers this bug. The manifest 401 is cosmetic but the/global/event401 crashes the UI with PasteTypeError, making the session page completely blank.Our workaround: the secondary server runs without auth (
OPENCODE_SERVER_PASSWORDunset) and we don't open its web UI at all. Instead, we proxy session messages through our own API endpoint and display CoT in a custom modal.The underlying issue is that the auth middleware doesn't exempt static assets (site.webmanifest, favicon) or the SSE event stream (
/global/event). Related to #12447 (closed) and #9206.rocordov commentedon May 5, 2026
Workaround implemented: We found that the manifest/event 401 crash is triggered by Basic auth on the OpenCode web server. Our workaround: don't use auth on the isolated server instance (just the main server on 4096). The isolated server is headless — we proxy its session API through our own web.py endpoint and display CoT/chat in a custom modal.
Root cause appears to be that the auth middleware doesn't exempt static assets (site.webmanifest, favicon) or the SSE event stream (/global/event). Related: #12447 (closed), #9206, #18302.
feat(server,app): replace Basic Auth dialog with custom login page
github-actions commentedon Jul 5, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.