Repository navigation
auth_token query param bypasses auth for HTML but not for subresource loads (CSS/JS) #31484
Description
Description
When OPENCODE_SERVER_PASSWORD is set, accessing the web UI with ?auth_token=<base64> returns 200 for the initial HTML request, but the browser then fetches subresources (/assets/index-*.js, /assets/index-*.css, favicons) without the auth_token query param. The server's authorizationRouterMiddleware returns 401 with WWW-Authenticate: Basic for those subresource requests → the browser shows its native HTTP Basic Auth dialog, effectively breaking the auth_token flow.
Root cause: isPublicUIPath in packages/opencode/src/server/shared/public-ui.ts only exempts a few manifest paths from auth. The Vite build output under /assets/ and other static assets (favicons, etc.) are not exempt, so they trigger the auth challenge on every page load.
Expected: Page loads without auth prompt.
Actual: 200 for the HTML, but /assets/index-*.js and /assets/index-*.css return 401 → browser pops up the native Basic Auth dialog.
Attempted fix: Adding /assets/ prefix check and missing favicon/manifest paths to isPublicUIPath in public-ui.ts. However the issue persisted even after the server restart, suggesting there may be another auth layer or caching behavior involved.
Plugins
none
OpenCode version
1.16.2
Steps to reproduce
- Set
OPENCODE_SERVER_PASSWORD=password123 - Run
opencode web - Open
http://localhost:4096/?auth_token=<base64("opencode:password123")>
Screenshot and/or share link
No response
Operating System
Windows 11
Terminal
WT
Activity
github-actions commentedon Jun 9, 2026
This issue might be a duplicate of existing issues. Please check:
/assets/,/site.webmanifest) whenOPENCODE_SERVER_PASSWORDis set, becauseisPublicUIPathdoes not exempt those paths. Also reported on Windows withopencode web.isPublicUIPath/credentials issue for subresources).If your issue is the same as one of these, please add a comment there instead so the fix can be tracked in one place.
JoeyLearnsToCode commentedon Jun 9, 2026
It's not a same issue.
feat(server,app): replace Basic Auth dialog with custom login page
github-actions commentedon Aug 9, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.