web: service worker intercepts OAuth callback and auth expiry causes silent 1s retry loop #50481

Activity

1. github-actions

   assigned

   Hona

   on Sep 22, 2026
2. sbaidon commented on Sep 27, 2026

   

   sbaidon

   on Sep 27, 2026

   More actions

   Same problem here behind Microsoft Dev Tunnels. The tunnel requires sign-in on every path, including /.

   Once the tunnel cookie expires, the service worker serves the cached index.html for /, so the request never reaches the tunnel and it can't redirect to sign-in. API calls then get a cross-origin 302 and fail without any error in the UI. Opening /api/session directly is the only way I've found to sign in again.

   One option that keeps cache-first navigation: if an API call fails and fetch(url, { redirect: "manual" }) comes back as opaqueredirect, navigate to something the service worker lets through, like /?reauth.

   @Hona, would you take a PR for that?

   👍React with 👍1Reacted by KillianGDK
3. KillianGDK-FDTI commented on Sep 29, 2026

   

   KillianGDK-FDTI

   on Sep 29, 2026

   More actions

   I reproduced this on OpenCode V2 2.0.18 at code.kgk.app, behind Cloudflare Tunnel + Access, using Brave’s installed PWA on Android. After the Access session expires, the app stays on “Loading”. A sign-in attempt returns to /cdn-cgi/access/authorized, but the service worker serves the cached app shell there; the router then reports “Unrecognised route”. Unregistering only the service worker restored the project/session list without clearing cookies.

   The generated worker’s navigation fallback excludes /api and /auth, but not /cdn-cgi/access/. Would you welcome a focused PR excluding Cloudflare’s callback path (and the /oauth2/ path described above) from the fallback? The separate expired-session UX could remain a follow-up.
4. sbaidon commented on Sep 30, 2026

   

   sbaidon

   on Sep 30, 2026

   More actions

   Opened #52223 for the expired-session part. It doesn't touch the callback-path exclusions, so it shouldn't overlap with a PR for those.
5. kolyavorobey28 commented on Oct 22, 2026

   

   kolyavorobey28

   on Oct 22, 2026

   More actions

   Hello everyone!
   Good grief, please bring back "Opencode Web"!
   I used to access Opencode via "Opencode Web," combined with a reverse proxy and Authelia.
   Everything worked perfectly. Since updating to version 2, I haven't been able to get it working at all.
   Now, when I navigate to my domain name, I go through the SSO process, only to end up on a page asking me to connect to an Opencode server—why on earth would I need that?!
   And I can't connect using either the "pair link" or the "use password" option.
   Please bring back "Opencode Web"! :(
6. kevinpark1217 commented on Oct 26, 2026

   

   kevinpark1217

   on Oct 26, 2026

   More actions

   If the token comes from an OAuth 2.0 / OIDC identity provider, I published an OpenCode 2 plugin for that case: opencode-oauth (opencode-oauth on npm). It signs a custom provider in with the authorization code flow and PKCE, and OpenCode refreshes the access token through it automatically, with no restart. It doesn't cover keys from a vault or a script.
7. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   More actions

   Thanks for the detailed report. I reproduced both problems on 2.0.8, and they still happen on the latest dev (fa1260d).

   Setup: opencode serve on 127.0.0.1 behind a small mock oauth2-proxy that gates only /api/* with a session cookie and redirects to a mock IdP on another origin. The app ran in headless Chromium with the service worker installed.

   • Retry loop: after the session cookie is removed and the open stream drops, GET /api/event is retried every ~1003 ms (9 requests in 10 s). Each request follows the 302 to the IdP and fails, and the UI shows no error or login prompt.
   • OAuth callback: going to /oauth2/callback?code=… never reaches the proxy. The service worker's navigateFallback serves the cached app instead, so the cookie is never set. The app shows its "Something went wrong" error screen, and the 302 loop continues. On dev, navigateFallbackDenylist in packages/app/vite.pwa.ts covers /api and /auth but not /oauth2.

   The script below reproduces both problems, and the screenshot shows the error screen at /oauth2/callback. I didn't test your point about the stale service worker failing to update /sw.js while logged out.

   Related: #47062 and #50370 (same reconnect loop, Basic-auth and 401 variants) and #48161 (reconnect backoff).

   

   Reproduction script (repro.mjs)

   // Reproduction for anomalyco/opencode#50481.
   // Usage: start `opencode serve --hostname 127.0.0.1 --port 4096` (note the printed password), then
   //   OC_PASSWORD=<password> node repro.mjs     (needs `npm i playwright && npx playwright install chromium`)
   // A mock oauth2-proxy on :8080 gates only /api/* behind a session cookie (302 to a mock IdP on :8081
   // when missing) and injects the server's Basic auth upstream. /oauth2/callback sets the cookie.
   import http from "node:http"
   import { chromium } from "playwright"
   
   const UPSTREAM = { host: "127.0.0.1", port: 4096 }
   const auth = "Basic " + Buffer.from("opencode:" + process.env.OC_PASSWORD).toString("base64")
   const log = []
   const t0 = Date.now()
   const streams = new Set() // open /api/event responses, dropped when the session "expires"
   
   http
     .createServer((req, res) => {
       // Mock IdP: login page that immediately "authenticates" and sends you back to the callback.
       if (req.url.startsWith("/login")) {
         res.writeHead(200, { "content-type": "text/html" })
         return res.end(`<html><body>IdP login<script>setTimeout(()=>location.href="http://localhost:8080/oauth2/callback?code=abc",50)</script></body></html>`)
       }
       res.writeHead(404).end()
     })
     .listen(8081)
   
   http
     .createServer((req, res) => {
       const cookie = /_oauth2_proxy=ok/.test(req.headers.cookie ?? "")
       log.push({ t: Date.now() - t0, url: req.url, cookie })
       if (req.url.startsWith("/oauth2/callback")) {
         res.writeHead(302, { "set-cookie": "_oauth2_proxy=ok; Path=/", location: "/" })
         return res.end()
       }
       if (req.url.startsWith("/oauth2/start")) {
         res.writeHead(302, { location: "http://localhost:8081/login" })
         return res.end()
       }
       if (req.url.startsWith("/api") && !cookie) {
         res.writeHead(302, { location: "http://localhost:8081/login" })
         return res.end()
       }
       if (req.url.startsWith("/api/event")) streams.add(res)
       const up = http.request({ ...UPSTREAM, path: req.url, method: req.method, headers: { ...req.headers, host: "127.0.0.1:4096", authorization: auth } }, (r) => {
         res.writeHead(r.statusCode, r.headers)
         r.pipe(res)
       })
       req.pipe(up)
       up.on("error", () => res.end())
     })
     .listen(8080)
   
   const browser = await chromium.launch()
   const ctx = await browser.newContext()
   await ctx.addCookies([{ name: "_oauth2_proxy", value: "ok", url: "http://localhost:8080" }])
   const page = await ctx.newPage()
   const consoleErrors = []
   page.on("console", (m) => m.type() === "error" && consoleErrors.push(m.text()))
   page.on("pageerror", (e) => consoleErrors.push(String(e)))
   
   console.log("1. load app while authenticated")
   await page.goto("http://localhost:8080/")
   await page.waitForTimeout(8000)
   console.log("   service worker controlling:", await page.evaluate(() => !!navigator.serviceWorker.controller))
   await page.reload()
   await page.waitForTimeout(4000)
   console.log("   service worker controlling after reload:", await page.evaluate(() => !!navigator.serviceWorker.controller))
   
   console.log("2. expire session cookie, watch /api/event for 10s")
   await ctx.clearCookies()
   for (const s of streams) s.destroy() // proxy/tunnel drops the open stream
   const start = log.length
   await page.waitForTimeout(10000)
   const ev = log.slice(start).filter((l) => l.url.startsWith("/api/event"))
   console.log(`   /api/event requests in 10s without cookie: ${ev.length} (all 302 to IdP)`)
   console.log("   gaps ms:", ev.slice(1).map((e, i) => e.t - ev[i].t).join(","))
   await page.screenshot({ path: "/workspace/repro/expired.png" })
   
   console.log("3. user goes through IdP which redirects to /oauth2/callback")
   const before = log.length
   await page.goto("http://localhost:8080/oauth2/callback?code=abc")
   await page.waitForTimeout(10000)
   const cb = log.slice(before).filter((l) => l.url.startsWith("/oauth2/"))
   console.log(`   /oauth2/* requests that reached the proxy: ${cb.length}`)
   console.log("   page URL:", page.url())
   console.log("   cookie set:", (await ctx.cookies()).some((c) => c.name === "_oauth2_proxy"))
   console.log("   console errors:", consoleErrors.filter((e) => /Unrecognised|route/i.test(e)).slice(0, 3))
   await page.screenshot({ path: "/workspace/repro/callback.png" })
   const after = log.slice(before).filter((l) => l.url.startsWith("/api/event")).length
   console.log(`   /api/event requests still hitting proxy without cookie in 10s after callback: ${after}`)
   console.log("   page text:", (await page.evaluate(() => document.body.innerText)).slice(0, 200).replace(/\n/g, " | "))
   console.log("   all console errors:", [...new Set(consoleErrors)].slice(0, 5))
   await browser.close()
   process.exit(0)

   Run it: bun repro.mjs
8. opencodejr

   added

   reproduced

   on Oct 28, 2026
9. Hamza-Abili commented on Oct 30, 2026

   

   Hamza-Abili

   on Oct 30, 2026

   More actions

   For the Authelia variant of this issue (401 + Location instead of a redirect), I added live-deployment details to #57834: #57834 (comment)

   Same symptoms: whole-site Authelia ForwardAuth, cached PWA shell, and Traefik DownstreamStatus=401 / OriginStatus=0. The PR's explicit 401 handling looks like the right path for this setup.