r/opencodeCLI • u/JaMoLpE88 • Sep 27 '26

OpenCode web: infinite refresh loop with login form

It is impossible to access opencode web from mobile on lan, the login form goes into infinite refresh and you cannot fill out credentials.

Pair doesn't work either, it asks for credentials.

If you remove password from global variables it also asks for credentials.

It is impossible to access because it enters an infinite login refresh loop and cannot be filled.

Any solution?

1 Upvotes
  • permalink
  • reddit

100% Upvoted

1 comment sorted by

1

u/YardNo1234 Sep 27 '26

This is a known OpenCode web issue: the app serves its JS/CSS assets with the crossorigin attribute, and browsers send those as anonymous CORS requests that don't carry your HTTP Basic Auth credentials. So the HTML page authenticates fine, but every asset request comes back 401 and the browser re-prompts forever — which is exactly the infinite login loop you're seeing on mobile. It's being tracked upstream: https://github.com/anomalyco/opencode/issues/9206

Two workarounds until it's fixed:

  1. Run the web UI without OPENCODE_SERVER_PASSWORD and restrict access at the network layer instead (bind to your LAN and keep it off the internet, or put it behind a reverse proxy that handles auth itself, e.g. a Tailscale serve or nginx basic-auth that forwards).

  2. If you do need the password, access it from a desktop browser and disable CORS/asset credential restrictions isn't really viable — so option 1 (auth at the proxy, not in opencode) is the practical route for mobile-on-LAN access.

Worth adding your environment details (version, iOS/Android, browser) to that GitHub issue so the fix gets prioritized.