starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #4037] [bug]: Desktop App not working for MacOs (cookies, cross-site-tracking) #1433

New issue

Open

opened 2026-03-16 20:19:21 +03:00 by kerem · 5 comments

kerem commented

2026-03-16 20:19:21 +03:00

Owner

Originally created by @mkohns on GitHub (May 6, 2024).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4037

Is there an existing issue for this?

I have searched the existing issues

Current behavior

The WebKit used by MacOS defaults to prevent any cookie cross-site-tracking. This prevents the desktop app to access a self hosted backend in non-dev enviroments. This is due to the fact that the tauri://localhost is first-class site and the backend ist hosted somewhere else. On Windows the WebKit does not have this issue but is marked for soon deprecation. The DevTools already point this out with a warning message.

Steps to reproduce

Build the desktop app on MacOs with self hosted backend.

Environment

Production

Version

Self-hosted

Originally created by @mkohns on GitHub (May 6, 2024). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4037 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior The WebKit used by MacOS defaults to prevent any cookie cross-site-tracking. This prevents the desktop app to access a self hosted backend in non-dev enviroments. This is due to the fact that the tauri://localhost is first-class site and the backend ist hosted somewhere else. On Windows the WebKit does not have this issue but is marked for soon deprecation. The DevTools already point this out with a warning message. ### Steps to reproduce Build the desktop app on MacOs with self hosted backend. ### Environment Production ### Version Self-hosted

kerem added the

bug

need testing

desktop

labels

2026-03-16 20:19:21 +03:00

kerem commented

2026-03-16 20:19:32 +03:00

Author

Owner

@mkohns commented on GitHub (May 6, 2024):

I dived quite deeply into this topic and learned a lot about what is really going on here. I have some solutions implemented with different security impacts. I am quite unsure about which way is planed for hoppscotch.
My current suggestion:

Implement different auth for windows and macos

1.) MacOs: use localstorage + JWT Bearer in Auth header. . This could be considered to be safe as in MacOs Webkit the localstorage is partioned and only accessable for the page who created the entry.
2.) Windows: use new partioned cookies as recommened by google as the localstorage will be not partioned.

This is working seemless on my fork.

I would like to talk to someone about all this before creating a PR.

@mkohns commented on GitHub (May 6, 2024): I dived quite deeply into this topic and learned a lot about what is really going on here. I have some solutions implemented with different security impacts. I am quite unsure about which way is planed for hoppscotch. My current suggestion: Implement different auth for windows and macos 1.) MacOs: use localstorage + JWT Bearer in Auth header. . This could be considered to be safe as in MacOs Webkit the localstorage is partioned and only accessable for the page who created the entry. 2.) Windows: use new partioned cookies as recommened by google as the localstorage will be not partioned. This is working seemless on my fork. I would like to talk to someone about all this before creating a PR.

kerem commented

2026-03-16 20:19:37 +03:00

Author

Owner

@SanskritiHarmukh commented on GitHub (May 6, 2024):

Hi @mkohns , we're actively working on this issue. We expect it to be resolved by the end of the month with the upcoming release of our revamped desktop app.

@SanskritiHarmukh commented on GitHub (May 6, 2024): Hi @mkohns , we're actively working on this issue. We expect it to be resolved by the end of the month with the upcoming release of our revamped desktop app.

kerem commented

2026-03-16 20:19:42 +03:00

Author

Owner

@mkohns commented on GitHub (May 6, 2024):

Hey this sounds great. Do you have some more details what will be revamped?

@mkohns commented on GitHub (May 6, 2024): Hey this sounds great. Do you have some more details what will be revamped?

kerem commented

2026-03-16 20:19:47 +03:00

Author

Owner

@SanskritiHarmukh commented on GitHub (May 6, 2024):

@AndrewBastin will be able to give more insights on this.

@SanskritiHarmukh commented on GitHub (May 6, 2024): @AndrewBastin will be able to give more insights on this.

kerem commented

2026-03-16 20:19:52 +03:00

Author

Owner

@mkohns commented on GitHub (May 7, 2024):

Hey @AndrewBastin nice to meet you!
Cool to hear that you are making revamping enhancements to the desktop app.
I also played around with the tauri + backend to get JWT Bearer working instead of cookies for Mac.
Could you give me some hints which major changes you are planning to do?

@mkohns commented on GitHub (May 7, 2024): Hey @AndrewBastin nice to meet you! Cool to hear that you are making revamping enhancements to the desktop app. I also played around with the tauri + backend to get JWT Bearer working instead of cookies for Mac. Could you give me some hints which major changes you are planning to do?