Repository navigation
fix(server): authenticate only API requests - #46702
Merged
Merged
Conversation
3 of 6 tasks
Brendonovich
enabled auto-merge (squash)
September 2, 2026 01:57
jinhuang712
pushed a commit
to jinhuang712/opencode
that referenced
this pull request
Sep 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Reported while debugging iPhone home-screen icons: Basic Auth blocked installation assets. No linked issue.
Type of change
What does this PR do?
Authenticate only
/api,/api/*, and/openapi.json. The app HTML, SPA routes, and all bundled static assets are public, including icons, manifests, fonts, and service workers. Session data and server operations remain protected. PTY connection-ticket validation and browser preflight handling are unchanged.Use the existing asset handler rather than an icon allowlist or separate public responder. Missing icons return 404 instead of SPA HTML, and successful static HEAD requests return 200.
This is an independent PR based directly on
v2, with no PWA layout or persistence changes. No existing app or live server was restarted or redeployed.How did you verify your code works?
packages/cli:bun test ./test/web-ui.test.ts: 1 passed.packages/server:bun test ./test/process.test.ts ./test/fetch.test.ts ./test/auth.test.ts ./test/pty-socket.test.ts ./test/persistent-pty.test.ts: 15 passed, 3 existing persistent-PTY skips because the smoke-test binary is unavailable.git diff --checkpassed.Screenshots / recordings
Not applicable: server authentication and static-response behavior only.
Checklist