starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-26 01:06:00 +03:00

[GH-ISSUE #5424] [bug]: Login desktop app #2083

New issue

Open

opened 2026-03-16 23:07:11 +03:00 by kerem · 4 comments

kerem commented

2026-03-16 23:07:11 +03:00

Owner

Originally created by @floviolleau on GitHub (Oct 1, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5424

Originally assigned to: @CuriousCorrelation on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Platform

Desktop App

Browser

Other (specify in additional info)

Operating System

Linux

Bug Description

What happened?

I'm unable to login with Linux desktop app.
Version are the same between Web and Desktop 2025.9.1

When I click on Login on Destkop, it opens a new tab on my browser and I'm redirected to the destkop app and it spin loops forever.

If I open dev-tools CTRL + SHIFT + I, I can see my tokens in the console log:

In the network tab, I have t his 400 Bad Request:

{
    "kind": "success",
    "response": {
        "id": 1759341568541,
        "status": 400,
        "statusText": "400 Bad Request",
        "version": "HTTP/1.1",
        "headers": {
            "Access-Control-Allow-Credentials": "true",
            "Vary": "Origin",
            "X-Powered-By": "Express",
            "Set-Cookie": "connect.sid=s%3AQfTzAHCLxlKI7d4jJqI3Mlr6suPyDoAX.oc%2FjTBkrAihpeE7%2BCnzvoDQGJrC3Ebs1qwNUTYVCEkU; Path=/; HttpOnly",
            "Connection": "keep-alive",
            "Etag": "W/\"602-VJ1y2DbEADhG73EnUXYYCtgZslo\"",
            "Date": "Wed, 01 Oct 2025 17:59:28 GMT",
            "Content-Length": "1538",
            "Content-Type": "application/json; charset=utf-8",
            "Server": "nginx/1.22.1"
        },
        "cookies": null,
        "body": {
            "body": [
                123,
                34,
                101,
                114,
                114,
                [...]
            ],
            "mediaType": "application/json"
        },
        "meta": {
            "timing": {
                "start": 1759341568546,
                "end": 1759341568593
            },
            "size": {
                "headers": 428,
                "body": 1538,
                "total": 1966
            }
        }
    }
}

Here is my docker-compose.yml:

services:
  # The service that spins up all services at once in one container
  hoppscotch-aio:
    container_name: hoppscotch-aio
    restart: unless-stopped
    build:
      dockerfile: prod.Dockerfile
      context: .
      target: aio
    env_file:
      - ./.env
    depends_on:
      hoppscotch-db:
        condition: service_healthy
    ports:
      - "3300:3000"
      - "3100:3100"
      - "3170:3170"
      - "3200:3200"
      - "3080:80"

  # The preset DB service, you can delete/comment the below lines if
  # you are using an external postgres instance
  # This will be exposed at port 5432
  hoppscotch-db:
    image: postgres:15-alpine
    ports:
      - "5432:5432"
    user: postgres
    environment:
      # The default user defined by the docker image
      POSTGRES_USER: <redacted>
      # NOTE: Please UPDATE THIS PASSWORD!
      POSTGRES_PASSWORD: <redacted>
      POSTGRES_DB: hoppscotch
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "sh -c 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}'",
        ]
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - hoppscotch-pgdata:/var/lib/postgresql/data

  # Auto-migration service - handles database migrations automatically
  hoppscotch-migrate:
    profiles: ["default", "just-backend", "backend", "app", "admin"]
    build:
      dockerfile: prod.Dockerfile
      context: .
      target: backend
    env_file:
      - ./.env
    depends_on:
      hoppscotch-db:
        condition: service_healthy
    command: sh -c "pnpx prisma migrate deploy"

volumes:
  hoppscotch-pgdata:

Here is my nginx vhost:

server {
    listen 443 ssl http2;
    server_name hoppscotch.test.dev;

    location / {
        proxy_set_header Host $host;
        proxy_pass http://localhost:3080/;
        proxy_redirect off;
    }

    ssl_certificate /etc/nginx/ssl/testdev.crt;
    ssl_certificate_key /etc/nginx/ssl/testdev.key;

    add_header 'Access-Control-Allow-Origin' 'https://hoppscotch.test.dev';
    add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, x-apollo-operation-name, apollo-require-preflight';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Origin' '*';
}

server {
    if ($host = hoppscotch.test.dev) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    server_name hoppscotch.test.dev;
    return 404;
}

Deployment Type

Self-hosted (on-prem deployment)

Version

2025.9.1

Originally created by @floviolleau on GitHub (Oct 1, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5424 Originally assigned to: @CuriousCorrelation on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Platform Desktop App ### Browser Other (specify in additional info) ### Operating System Linux ### Bug Description ## What happened? I'm unable to login with Linux desktop app. Version are the same between Web and Desktop 2025.9.1 When I click on Login on Destkop, it opens a new tab on my browser and I'm redirected to the destkop app and it spin loops forever. If I open dev-tools CTRL + SHIFT + I, I can see my tokens in the console log: <img width="1900" height="897" alt="Image" src="https://github.com/user-attachments/assets/5094259d-0907-470e-9e58-452393afc790" /> In the network tab, I have t his 400 Bad Request: ``` { "kind": "success", "response": { "id": 1759341568541, "status": 400, "statusText": "400 Bad Request", "version": "HTTP/1.1", "headers": { "Access-Control-Allow-Credentials": "true", "Vary": "Origin", "X-Powered-By": "Express", "Set-Cookie": "connect.sid=s%3AQfTzAHCLxlKI7d4jJqI3Mlr6suPyDoAX.oc%2FjTBkrAihpeE7%2BCnzvoDQGJrC3Ebs1qwNUTYVCEkU; Path=/; HttpOnly", "Connection": "keep-alive", "Etag": "W/\"602-VJ1y2DbEADhG73EnUXYYCtgZslo\"", "Date": "Wed, 01 Oct 2025 17:59:28 GMT", "Content-Length": "1538", "Content-Type": "application/json; charset=utf-8", "Server": "nginx/1.22.1" }, "cookies": null, "body": { "body": [ 123, 34, 101, 114, 114, [...] ], "mediaType": "application/json" }, "meta": { "timing": { "start": 1759341568546, "end": 1759341568593 }, "size": { "headers": 428, "body": 1538, "total": 1966 } } } } ``` Here is my docker-compose.yml: ``` services: # The service that spins up all services at once in one container hoppscotch-aio: container_name: hoppscotch-aio restart: unless-stopped build: dockerfile: prod.Dockerfile context: . target: aio env_file: - ./.env depends_on: hoppscotch-db: condition: service_healthy ports: - "3300:3000" - "3100:3100" - "3170:3170" - "3200:3200" - "3080:80" # The preset DB service, you can delete/comment the below lines if # you are using an external postgres instance # This will be exposed at port 5432 hoppscotch-db: image: postgres:15-alpine ports: - "5432:5432" user: postgres environment: # The default user defined by the docker image POSTGRES_USER: <redacted> # NOTE: Please UPDATE THIS PASSWORD! POSTGRES_PASSWORD: <redacted> POSTGRES_DB: hoppscotch healthcheck: test: [ "CMD-SHELL", "sh -c 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}'", ] interval: 5s timeout: 5s retries: 10 volumes: - hoppscotch-pgdata:/var/lib/postgresql/data # Auto-migration service - handles database migrations automatically hoppscotch-migrate: profiles: ["default", "just-backend", "backend", "app", "admin"] build: dockerfile: prod.Dockerfile context: . target: backend env_file: - ./.env depends_on: hoppscotch-db: condition: service_healthy command: sh -c "pnpx prisma migrate deploy" volumes: hoppscotch-pgdata: ``` Here is my nginx vhost: ``` server { listen 443 ssl http2; server_name hoppscotch.test.dev; location / { proxy_set_header Host $host; proxy_pass http://localhost:3080/; proxy_redirect off; } ssl_certificate /etc/nginx/ssl/testdev.crt; ssl_certificate_key /etc/nginx/ssl/testdev.key; add_header 'Access-Control-Allow-Origin' 'https://hoppscotch.test.dev'; add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, x-apollo-operation-name, apollo-require-preflight'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Origin' '*'; } server { if ($host = hoppscotch.test.dev) { return 301 https://$host$request_uri; } listen 80; server_name hoppscotch.test.dev; return 404; } ``` ### Deployment Type Self-hosted (on-prem deployment) ### Version 2025.9.1

kerem added the

bug

need testing

labels

2026-03-16 23:07:11 +03:00

kerem commented

2026-03-16 23:07:24 +03:00

Author

Owner

@CuriousCorrelation commented on GitHub (Oct 3, 2025):

Hello @floviolleau, Thanks for the report.

The 400 Bad Request error combined with the infinite spinner typically points to the desktop application failing to communicate with your backend and might not necessarily be a bug with the desktop app.

Although just to be sure, could you please check the desktop app’s logs?
For Linux, those typically reside in ~/.local/share/io.hoppscotch.desktop/logs/io.hoppscotch.desktop.log.
Look for requests and errors around the time of login attempts.

It could also be related to how you have set up nginx + SSL. The desktop app needs to trust your SSL certificates for it to make requests to the hosted backend.

Try this temporary test to see if it's certificate related:

Open the Desktop App Settings
Go to Native (interceptor settings)
Temporarily disable "Verify Host" and "Verify Peer"
Restart the application
Try logging in again

This is similar to the issue discussed in #4875.

Also just in case you haven’t - make sure your .env file includes the desktop app origins in the correct format. For https://hoppscotch.test.dev, you need:

WHITELISTED_ORIGINS=https://hoppscotch.test.dev,app://hoppscotch_test_dev,http://app.hoppscotch_test_dev

Note that dots (.) in your domain should be replaced with underscores (_), and you need both app:// and http://app. prefixes.

@CuriousCorrelation commented on GitHub (Oct 3, 2025): Hello @floviolleau, Thanks for the report. The 400 Bad Request error combined with the infinite spinner typically points to the desktop application failing to communicate with your backend and might not necessarily be a bug with the desktop app. Although just to be sure, could you please check the desktop app’s logs? For Linux, those typically reside in `~/.local/share/io.hoppscotch.desktop/logs/io.hoppscotch.desktop.log`. Look for requests and errors around the time of login attempts. It could also be related to how you have set up nginx + SSL. The desktop app needs to trust your SSL certificates for it to make requests to the hosted backend. Try this temporary test to see if it's certificate related: 1. Open the Desktop App Settings 2. Go to **Native (interceptor settings)** 3. Temporarily disable **"Verify Host"** and **"Verify Peer"** 4. Restart the application 5. Try logging in again This is similar to the issue discussed in [#4875](https://github.com/hoppscotch/hoppscotch/discussions/4875). Also just in case you haven’t - make sure your `.env` file includes the desktop app origins in the correct format. For `https://hoppscotch.test.dev`, you need: ``` WHITELISTED_ORIGINS=https://hoppscotch.test.dev,app://hoppscotch_test_dev,http://app.hoppscotch_test_dev ``` Note that dots (`.`) in your domain should be replaced with underscores (`_`), and you need both `app://` and `http://app.` prefixes.

kerem commented

2026-03-16 23:07:29 +03:00

Author

Owner

@techieadi4703 commented on GitHub (Oct 6, 2025):

I'm interested in this issue can you assign me this issue to me. @floviolleau @CuriousCorrelation @abraham @silentmatt @kant

@techieadi4703 commented on GitHub (Oct 6, 2025): I'm interested in this issue can you assign me this issue to me. @floviolleau @CuriousCorrelation @abraham @silentmatt @kant

kerem commented

2026-03-16 23:07:35 +03:00

Author

Owner

@liyasthomas commented on GitHub (Oct 6, 2025):

Feel free to give it a try @techieadi4703.

@liyasthomas commented on GitHub (Oct 6, 2025): Feel free to give it a try @techieadi4703.

kerem commented

2026-03-16 23:07:40 +03:00

Author

Owner

@floviolleau commented on GitHub (Dec 19, 2025):

Hi,

Thanks @CuriousCorrelation for all hints but since the new version it seems to be solved (I upgraded to Desktop: 2025.3.0 and backoffice:

But now I have inside Desktop app at https://hoppscotch.test.dev/backend/graphql:
Failed to load resource: Access-Control-Allow-Origin cannot contain more than one origin.

Here is my updated nginx config:

server {
    listen 443 ssl http2;
    server_name hoppscotch.test.dev;

    location / {
        proxy_set_header Host $host;
        proxy_pass http://localhost:3080/;
        proxy_redirect off;
    }

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;


    ssl_certificate /etc/nginx/ssl/testdev.crt;
    ssl_certificate_key /etc/nginx/ssl/testdev.key;

    add_header 'Access-Control-Allow-Origin' 'https://hoppscotch.test.dev';
    add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, x-apollo-operation-name, apollo-require-preflight';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Origin' '*';
}

server {
    if ($host = hoppscotch.test.dev) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    server_name hoppscotch.test.dev;
    return 404;
}

@floviolleau commented on GitHub (Dec 19, 2025): Hi, Thanks @CuriousCorrelation for all hints but since the new version it seems to be solved (I upgraded to Desktop: 2025.3.0 and backoffice: But now I have inside Desktop app at https://hoppscotch.test.dev/backend/graphql: Failed to load resource: Access-Control-Allow-Origin cannot contain more than one origin. Here is my updated nginx config: ``` nginx server { listen 443 ssl http2; server_name hoppscotch.test.dev; location / { proxy_set_header Host $host; proxy_pass http://localhost:3080/; proxy_redirect off; } proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; ssl_certificate /etc/nginx/ssl/testdev.crt; ssl_certificate_key /etc/nginx/ssl/testdev.key; add_header 'Access-Control-Allow-Origin' 'https://hoppscotch.test.dev'; add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, x-apollo-operation-name, apollo-require-preflight'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Origin' '*'; } server { if ($host = hoppscotch.test.dev) { return 301 https://$host$request_uri; } listen 80; server_name hoppscotch.test.dev; return 404; } ```

kerem referenced this issue

2026-03-17 01:13:18 +03:00

[PR #2083] [MERGED] feat: Ensure Method In Endpoint #3622