desktop: local service on Tailscale receives unauthenticated requests #51075

Activity

1. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   Contributor

   More actions

   Thanks for the detailed report and the request evidence. Our automated environment can't run the Electron desktop app, so a maintainer with a desktop Linux setup will need to reproduce this.

   The current code matches what you describe. In packages/desktop/src/main/windows/security.ts, wireRendererHeaders registers onBeforeSendHeaders only for http://127.0.0.1/* and http://localhost/*. The desktop app will still adopt a registered service on any address (it only rewrites 0.0.0.0 to 127.0.0.1). So when that service listens on a Tailscale or other non-loopback IP, the window's requests never reach the handler that adds the Authorization header, which explains the 401 you saw on /api/experimental/migration/v1. That filter has not changed on the current main line.

   Related, for reference:

   • Desktop app: session list stuck on "Loading..." — window gets 401 from its own background service #53834: a desktop window getting 401s from its own background service, on loopback (Windows)
   • [BUG] v2.0.12: Infinite loading of sessions/models, all API endpoints return 401 Unauthorized with no password set #50369: a similar 401 symptom with opencode serve
2. TheCupcakeisalie commented on Nov 13, 2026

   

   TheCupcakeisalie

   on Nov 13, 2026

   More actions

   Still reproduces on 2.2.7 (official Linux x64 AppImage, Ubuntu 24.04, X11). In current builds it shows up as a "Signed out of this server — {server} no longer accepts this app's sign-in" screen instead of the loading/migration error, so I'm noting the new wording in case it helps others find this issue.

   Setup: ~/.config/opencode/service.json sets hostname to the machine's Tailscale IP, so other devices on the tailnet can share the service. The desktop app adopts that service (v2 CLI background service ready … probed: true), then every renderer call to /api/info, /api/event, /api/config and /api/experimental/migration/v1 gets a 401. Capturing the renderer's traffic over CDP showed no Authorization header on those requests. The same endpoint returns 200 with Basic opencode:<password>.

   Widening the onBeforeSendHeaders URL filter in the shipped app.asar fixes it right away. The exact-origin and top-level-renderer checks in the handler keep the credential scoped to the service. #60525 looks like the right fix. It would be great to get it reviewed, since #51076 was auto-closed for age.