You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add CORS middleware for Firefox localhost development compatibility #744
Add CORS support for localhost development in Firefox
Firefox enforces stricter CORS policies than other browsers, even for localhost origins. The opencode server currently has no CORS middleware configured, causing Firefox to block cross-origin requests
Current Behavior
Chrome/Safari: Requests from localhost:5173 → localhost:4096 work fine
Firefox/Zen: Same requests fail with CORS error
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://127.0.0.1:4096/session. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 404.
Proposed Solution
Add CORS middleware to the Hono server with localhost-specific configuration.
import{cors}from"hono/cors"functionapp(){constapp=newHono()constresult=app.onError((err,c)=>{// ... existing error handling}).use("*",cors({origin: (origin)=>{// Allow localhost origins on any port for developmentconstlocalhostPattern=/^https?:\/\/localhost(:\d+)?$/constlocalhostIPPattern=/^https?:\/\/127\.0\.0\.1(:\d+)?$/if(localhostPattern.test(origin)||localhostIPPattern.test(origin)){returnorigin}returnnull// Reject other origins},allowMethods: ["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders: ["Content-Type","Authorization","X-Requested-With"],exposeHeaders: ["Content-Length","X-Request-ID"],credentials: true,maxAge: 86400,// 24 hours for development}),).use(async(c,next)=>{// ... existing logging middleware})// ... rest of route definitionsreturnresult}
Actually, not sure if it was a flaw when I was testing, but I'm actually now seeing the CORS error happen in Chrome/Safari too now.
For context, I'm messing around with building a web UI using the server endpoints, and for now I've been getting around by just building the latest version of dev branch with this change to run locally for now
Maybe i should just do this in a fork serving it straight from root route of 4096
Activity
chris-tse commentedon Jul 12, 2025
Actually, not sure if it was a flaw when I was testing, but I'm actually now seeing the CORS error happen in Chrome/Safari too now.
For context, I'm messing around with building a web UI using the server endpoints, and for now I've been getting around by just building the latest version of dev branch with this change to run locally for now
Maybe i should just do this in a fork serving it straight from root route of 4096
chris-tse commentedon Jul 20, 2025
With the introduction of the various SDKs, this issue isn't really going to be a thing with my use case anymore. Going to close for now.
Add Turkish (tr) docs and update README (anomalyco#744)