Skip to content

fix(desktop): authenticate non-loopback local services - #51076

Closed
eivindjonassen wants to merge 1 commit into
anomalyco:devfrom
eivindjonassen:desktop-service-auth
Closed

fix(desktop): authenticate non-loopback local services#51076
eivindjonassen wants to merge 1 commit into
anomalyco:devfrom
eivindjonassen:desktop-service-auth

Conversation

@eivindjonassen

@eivindjonassen eivindjonassen commented Sep 24, 2026

Copy link
Copy Markdown

Issue for this PR

Closes #51075

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

Desktop discovers local services bound to non-loopback addresses, but its request-header filter only matches 127.0.0.1 and localhost. On a Tailscale-bound service, this causes unauthenticated requests, a stuck loading screen, and "Data migration failed" even when migration is complete.

Match HTTP(S) requests and let the existing exact-origin check restrict credentials to the registered service. The top-level renderer check and explicit Authorization header handling remain in place.

How did you verify your code works?

  • Added a real Electron regression test. It fails with 401 before the fix and passes afterward, including checks for unrelated origins, child frames, untrusted pages, requests without a frame, and explicit credentials.
  • The fixture maps test hostnames to loopback, so it needs no Tailscale connection. Like the existing native Electron tests, it is skipped in CI without a display.
  • Eight focused tests pass: bun run test test/renderer-auth.test.ts src/main/service/sidecar-credentials.test.ts src/main/windows/headers.test.ts from packages/desktop.
  • bun run check passes from the repository root with Bun 1.4.2.
  • Verified the equivalent local fix against Desktop 2.0.16 on Linux: startup migration check returns 200, session content loads, and event-stream disconnects stop.

Screenshots / recordings

Not applicable to this request-authentication fix.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

@github-actions

github-actions Bot commented Sep 24, 2026

Copy link
Copy Markdown
Contributor

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

  1. Open an issue describing the bug/feature (if one doesn't exist)
  2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

@github-actions

github-actions Bot commented Sep 24, 2026

Copy link
Copy Markdown
Contributor

The following comment was made by an LLM, it may be inaccurate:

@eivindjonassen

eivindjonassen commented Sep 24, 2026

Copy link
Copy Markdown
Author

The check and test workflows are awaiting maintainer approval, with no jobs started. Could a maintainer approve those runs?

The PR description already includes Closes #51075. The needs:issue label appears to be a false positive: the standards workflow checks closingIssuesReferences, which is empty for this PR targeting v2 rather than the default branch. The v2 copy of that workflow already includes a fallback for issue references in the description. Could the label also be cleared?

Local verification passed: eight focused tests, including the real Electron regression, and bun run check with Bun 1.4.2.

@thdxr
thdxr changed the base branch from v2 to dev October 10, 2026 19:16
@github-actions

github-actions Bot commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

  • The PR was created more than 1 month ago
  • The PR had fewer than 2 positive reactions
  • Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.

@github-actions github-actions Bot closed this Oct 24, 2026
@github-actions github-actions Bot mentioned this pull request Oct 24, 2026
Open
@TheCupcakeisalie TheCupcakeisalie mentioned this pull request Nov 13, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated-pr-cleanup

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

desktop: local service on Tailscale receives unauthenticated requests

1 participant

@eivindjonassen