Repository navigation
hosted UI fallback proxy should strip credential headers #33046
Description
Problem
When the embedded web UI is unavailable and the server falls back to proxying a hosted UI origin, request headers are forwarded after only hop-by-hop/opencode-specific filtering.
That fallback path should never forward browser credentials such as Authorization or Cookie to a hosted UI origin.
Expected
The UI proxy fallback should strip credential-bearing headers before forwarding the request upstream.
Actual
authorization, cookie, and related credential headers can remain in the forwarded header set.
Notes
This does not propose using the hosted UI fallback as a production baseline. It is a containment fix for the fallback path so that accidental fallback does not forward local credentials.
Prepared with AI assistance.
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Jun 20, 2026
This issue doesn't fully meet our contributing guidelines.
What needs to be fixed:
Please edit this issue to address the above within 2 hours, or it will be automatically closed.
If you believe this was flagged incorrectly, please let a maintainer know.
github-actions commentedon Jun 20, 2026
This issue has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.
Feel free to open a new issue that follows our issue templates.