Repository navigation
Web UI features fail over non-localhost HTTP origins: crypto.randomUUID unavailable in insecure context (session delete, file attach) #46168
Description
Summary
Multiple Web UI features break when the Web UI is served over a non-localhost HTTP origin (e.g., a Tailscale hostname http://hostname:49374): the app calls crypto.randomUUID() directly, which is only available in secure contexts, so the calls throw TypeError: crypto.randomUUID is not a function and the action silently fails. Verified for (at least) file drag-drop attach and session delete. Everything works over http://localhost / http://127.0.0.1 (trusted origins).
Environment
- opencode version: 0.0.0-beta-18414 (v2/beta line)
- Interface: Web UI via background service
http://0.0.0.0:49374 - Access:
http://nico.tail194715.ts.net:49374(Tailscale hostname, plain HTTP →isSecureContext: false) - Browser: Chrome
Reproduction
- Access the Web UI via a non-localhost HTTP hostname (e.g., Tailscale).
- Session delete: open a session → "その他のオプション" menu → "削除..." → confirm "セッションを削除".
- Nothing happens: the dialog stays open, no DELETE request is sent, and the console shows
Uncaught (in promise):TypeError: crypto.randomUUID is not a function at Object.remove (runtime-…:651) at M (route-…:81) // session delete click handler
- Nothing happens: the dialog stays open, no DELETE request is sent, and the console shows
- File attach: drag a file onto the composer (the drop overlay appears) → the file is not added, nothing is uploaded; same
crypto.randomUUID is not a functionunhandled rejection.
Expected Behavior
- Session deletion should complete (dialog closes, session removed) regardless of the origin used, including Tailscale/remote hostnames over plain HTTP
- File attachments should be added to the composer on any origin
Actual Behavior
- Both actions throw on
crypto.randomUUID(insecure context) and never reach the server API - Verified successful on
http://localhost:49374(secure context) for both features — confirming the root cause is origin-dependent, not a server issue
Root Cause
The shipped (v2/beta) bundle calls crypto.randomUUID() directly in the affected code paths (delete mutation, attachment part id generation) without a fallback. crypto.randomUUID is defined only in secure contexts (HTTPS or explicitly trusted origins like localhost). The dev branch already has a guarded uuid() util with a fallback for insecure contexts (packages/app/src/utils/uuid.ts), which should be used in these paths.
Suggested fix direction
- Replace bare
crypto.randomUUID()calls in the app bundle with theuuid()util (fallback for insecure contexts), or otherwise ensure IDs are generated without requiring a secure context - Audit other
crypto.randomUUIDusages in the web UI for the same class of failure over remote HTTP origins
Notes
- Affects remote/network access patterns (Tailscale, LAN hostnames) which are common for the v2 preview
- Same-family failure observed previously for file drag-drop attachment
Activity
github-actions commentedon Aug 29, 2026
This issue might be a duplicate of existing issues. Please check:
Cannot read properties of undefined (reading 'digest')when accessing via HTTP on non-localhost #41706: Same root cause — Web Crypto API unavailable on non-localhost plain HTTP origins. That issue covers image paste failures viacrypto.subtle.digest; this issue covers session delete and file drag-drop viacrypto.randomUUID. Both stem from the same class of insecure-context restriction and thedevbranch already has auuid()util with a fallback for this. The fixes are closely related and may be resolved together.LoikStyle commentedon Aug 31, 2026
Cross-reference: related but not a duplicate of #46419 / PR #46418.
#46418 adds a fallback for
crypto.subtleinpackages/app/src/utils/draft-store.ts(blob ID generation for image attachments). Same root-cause class as this issue (crypto APIs unavailable on insecure origins), butcrypto.randomUUIDhere is separate: theuuid()helper already falls back to random, while the directcrypto.randomUUID()call sites flagged here are outside my change.opencodejr commentedon Oct 28, 2026
Thanks for the detailed report and root-cause analysis!
This was reported on an early beta build (
0.0.0-beta-18414). In the released 2.x versions, both of the paths you describe already use the HTTP-safeuuid()helper (it falls back whencrypto.randomUUIDis unavailable or the page isn't a secure context):packages/app/src/runtime/server/data.ts)packages/app/src/composer/attachments/)Could you upgrade to the latest 2.x release (currently
v2.2.0) and check whether session delete and drag-and-drop attach still fail over your Tailscale HTTP origin? If they do, please include:opencode --versionYou can reply here with the details, or edit the issue. If you edit it, please also leave a comment saying you've updated it so we know you're done.
Related issues about the same kind of insecure-origin failure, ordered by likelihood of overlap:
crypto.randomUUID is not a functionover plain HTTP (still open on v2)crypto.subtle)nico2525nn commentedon Oct 31, 2026
Verified fixed on
opencode v2.2.1.Both paths from the original report now use the HTTP-safe
uuid()helper (packages/app/src/runtime/persistence/uuid.ts), which falls back whencrypto.randomUUIDis unavailable or the page is not a secure context:packages/app/src/runtime/server/data.tsusesuuid()for the remove mutation (no directcrypto.randomUUIDremaining)packages/app/src/composer/attachments/attachments.tsanddestination.tsuseuuid()for attachment IDs and upload pathsSession delete and drag-and-drop attach now work over the Tailscale plain-HTTP origin. Closing as fixed. Thanks!
opencodejr commentedon Oct 31, 2026
We haven't heard back, so we're closing this for now.
This was reported on an early beta build (
0.0.0-beta-18414). In the released 2.x versions, session delete and file attachments already use an HTTP-safe ID helper instead of callingcrypto.randomUUID()directly, so these two failures should be gone. We were waiting to hear whether you still see them on a current 2.x release.If session delete or drag-and-drop attach still fails over your Tailscale HTTP origin on the latest 2.x, please reply with your
opencode --versionoutput and the console error, and we can reopen. Other features that fail on insecure origins are tracked in #55777 (sending prompts) and #59791 ("Open file"). Thanks again for the thorough report!