Skip to content

Add CORS middleware for Firefox localhost development compatibility #744

Closed

Description

@chris-tse

Add CORS support for localhost development in Firefox

Firefox enforces stricter CORS policies than other browsers, even for localhost origins. The opencode server currently has no CORS middleware configured, causing Firefox to block cross-origin requests

Current Behavior

  • Chrome/Safari: Requests from localhost:5173 → localhost:4096 work fine
  • Firefox/Zen: Same requests fail with CORS error
    Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://127.0.0.1:4096/session. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 404.
    

Proposed Solution

Add CORS middleware to the Hono server with localhost-specific configuration.

import { cors } from "hono/cors"

function app() {
  const app = new Hono()

  const result = app
    .onError((err, c) => {
      // ... existing error handling
    })
    .use(
      "*",
      cors({
        origin: (origin) => {
          // Allow localhost origins on any port for development
          const localhostPattern = /^https?:\/\/localhost(:\d+)?$/
          const localhostIPPattern = /^https?:\/\/127\.0\.0\.1(:\d+)?$/

          if (
            localhostPattern.test(origin) ||
            localhostIPPattern.test(origin)
          ) {
            return origin
          }

          return null // Reject other origins
        },
        allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
        allowHeaders: ["Content-Type", "Authorization", "X-Requested-With"],
        exposeHeaders: ["Content-Length", "X-Request-ID"],
        credentials: true,
        maxAge: 86400, // 24 hours for development
      }),
    )
    .use(async (c, next) => {
      // ... existing logging middleware
    })
  // ... rest of route definitions

  return result
}

Activity

  1. self-assigned this
    on Jul 9, 2025
  2. chris-tse commented on Jul 12, 2025

    @chris-tse
    Author

    Actually, not sure if it was a flaw when I was testing, but I'm actually now seeing the CORS error happen in Chrome/Safari too now.

    For context, I'm messing around with building a web UI using the server endpoints, and for now I've been getting around by just building the latest version of dev branch with this change to run locally for now

    Maybe i should just do this in a fork serving it straight from root route of 4096

  3. chris-tse commented on Jul 20, 2025

    @chris-tse
    Author

    With the introduction of the various SDKs, this issue isn't really going to be a thing with my use case anymore. Going to close for now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions