starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-26 01:06:00 +03:00

[GH-ISSUE #5493] [bug]: Cannot add self-hosted instance to desktop app #2112

New issue

Open

opened 2026-03-16 23:13:52 +03:00 by kerem · 7 comments

kerem commented

2026-03-16 23:13:52 +03:00

Owner

Originally created by @silver886 on GitHub (Oct 18, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5493

Originally assigned to: @CuriousCorrelation on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Platform

Desktop App

Browser

Firefox

Operating System

Windows

Bug Description

What happened?

When I add my self-host instance to desktop app, I get this error:

Verification error: Key validation failed: HTTP request failed: error sending request for url (https://hoppscotch-app.mydomain.com/desktop-app-server/api/v1/key)

However, the http url works just fine.

Steps to reproduce

Add a new instance (with HTTPS)
See error

Additional details

I tried the endpoints listed in this file, https://github.com/hoppscotch/hoppscotch/blob/main/packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/src/api/client.rs, and all of them work just fine.

> curl https://hoppscotch-app.mydomain.com/desktop-app-server/api/v1/key
HTTP/1.1 200 OK
Date: Sat, 18 Oct 2025 09:10:05 GMT
Content-Type: application/json
Content-Length: 78
Connection: keep-alive
cf-cache-status: DYNAMIC
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Speculation-Rules: "/cdn-cgi/speculation"
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=v6V%2FeLax [[ REDACTED ]]
alt-svc: h3=":443"; ma=86400

{
    "success": true,
    "data": {
        "key": "hWGaw3QHHrH2DD0r5EOhVRqePolx/a0VEhZ5lkqxGac="
    }
}

> curl https://hoppscotch-app.mydomain.com/desktop-app-server/api/v1/manifest
HTTP/1.1 200 OK
Date: Sat, 18 Oct 2025 09:12:06 GMT
Content-Type: application/json
Content-Length: 58895
Connection: keep-alive
cf-cache-status: DYNAMIC
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Speculation-Rules: "/cdn-cgi/speculation"
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=aWKRR5W [[ REDACTED ]] 
alt-svc: h3=":443"; ma=86400

{
    "success": true,
    "data": {
        "version": "2025.9.2",
        "created_at": "2025-10-18T06:26:53.987435232Z",
        "signature": "hU7uF0S4JtmRa430x96SYCe5wBGH/EahqFVBRBMz8MTS9K7aQlLcryaZZq5bKhv+rvvAiclYco/PaCy/O2/6BA==",
        "manifest": {
            "files": [
                {
                    "path": "icon.png",
                    "size": 127152,
 [[ REDACTED ]]

> curl https://hoppscotch-app.mydomain.com/desktop-app-server/api/v1/bundle
HTTP/1.1 200 OK
Date: Sat, 18 Oct 2025 09:13:42 GMT
Content-Type: application/zip
Content-Length: 29228044
Connection: keep-alive
content-disposition: attachment; filename="bundle.zip"
cf-cache-status: DYNAMIC
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Speculation-Rules: "/cdn-cgi/speculation"
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=x7RnWO8 [[ REDACTED ]] 
alt-svc: h3=":443"; ma=86400

+-----------------------------------------+
| NOTE: binary data not shown in terminal |
+-----------------------------------------+

Deployment Type

Self-hosted (on-prem deployment)

Version

2025.9.2

Originally created by @silver886 on GitHub (Oct 18, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5493 Originally assigned to: @CuriousCorrelation on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Platform Desktop App ### Browser Firefox ### Operating System Windows ### Bug Description ## What happened? When I add my self-host instance to desktop app, I get this error: ```console Verification error: Key validation failed: HTTP request failed: error sending request for url (https://hoppscotch-app.mydomain.com/desktop-app-server/api/v1/key) ``` However, the http url works just fine. ## Steps to reproduce 1. Add a new instance (with HTTPS) 2. See error <img width="579" height="376" alt="Image" src="https://github.com/user-attachments/assets/4bd938ee-f31a-40b9-9756-7089334dc3bf" /> ## Additional details I tried the endpoints listed in this file, https://github.com/hoppscotch/hoppscotch/blob/main/packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/src/api/client.rs, and all of them work just fine. ```console > curl https://hoppscotch-app.mydomain.com/desktop-app-server/api/v1/key HTTP/1.1 200 OK Date: Sat, 18 Oct 2025 09:10:05 GMT Content-Type: application/json Content-Length: 78 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Speculation-Rules: "/cdn-cgi/speculation" Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=v6V%2FeLax [[ REDACTED ]] alt-svc: h3=":443"; ma=86400 { "success": true, "data": { "key": "hWGaw3QHHrH2DD0r5EOhVRqePolx/a0VEhZ5lkqxGac=" } } ``` ```console > curl https://hoppscotch-app.mydomain.com/desktop-app-server/api/v1/manifest HTTP/1.1 200 OK Date: Sat, 18 Oct 2025 09:12:06 GMT Content-Type: application/json Content-Length: 58895 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Speculation-Rules: "/cdn-cgi/speculation" Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=aWKRR5W [[ REDACTED ]] alt-svc: h3=":443"; ma=86400 { "success": true, "data": { "version": "2025.9.2", "created_at": "2025-10-18T06:26:53.987435232Z", "signature": "hU7uF0S4JtmRa430x96SYCe5wBGH/EahqFVBRBMz8MTS9K7aQlLcryaZZq5bKhv+rvvAiclYco/PaCy/O2/6BA==", "manifest": { "files": [ { "path": "icon.png", "size": 127152, [[ REDACTED ]] ``` ```console > curl https://hoppscotch-app.mydomain.com/desktop-app-server/api/v1/bundle HTTP/1.1 200 OK Date: Sat, 18 Oct 2025 09:13:42 GMT Content-Type: application/zip Content-Length: 29228044 Connection: keep-alive content-disposition: attachment; filename="bundle.zip" cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Speculation-Rules: "/cdn-cgi/speculation" Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=x7RnWO8 [[ REDACTED ]] alt-svc: h3=":443"; ma=86400 +-----------------------------------------+ | NOTE: binary data not shown in terminal | +-----------------------------------------+ ``` ### Deployment Type Self-hosted (on-prem deployment) ### Version 2025.9.2

kerem added the

bug

need testing

labels

2026-03-16 23:13:52 +03:00

kerem commented

2026-03-16 23:14:03 +03:00

Author

Owner

@lamicopalmato commented on GitHub (Oct 23, 2025):

I am running into the same SSL certificate trust issue with the Hoppscotch desktop app on macOS.

Setup details:

Hoppscotch AIO deployed on Ubuntu VM via Docker.

Application exposed through Nginx with SSL using self-signed certificates.

The web app works perfectly with no certificate errors.

The desktop app on macOS (idk on other OS) throws the same certificate trust error mentioned previously.

On the macOS client:

The self-signed CA certificate has been installed and trusted in the system keychain.

The CA certificate file was also copied to /etc/ssl/cert.pem to cover low-level verification requirements.

Despite these steps, the desktop app still fails to trust the self-signed certificate.

Additionally, when curling the API endpoint directly against the server:

bash
curl https://public-ip/desktop-app-server/api/v1/key

The response is:

json
{"success":true,"data":{"key":"GmIIgfbUdlJZUQMVSeXsq8UsU7hXEHHKxWw0JnTROUE="}}

This confirms the server is reachable and responding correctly over HTTPS.

Questions and suggestions:

Does the desktop app use a different mechanism or bundle of trusted CAs compared to the system/browser?

Could this be a limitation or bug in the desktop app’s certificate verification process on macOS?

Any recommended best practices or workarounds for using self-signed certs with the Hoppscotch desktop app for self-signed certificates?

Thanks for any guidance!

@lamicopalmato commented on GitHub (Oct 23, 2025): I am running into the same SSL certificate trust issue with the Hoppscotch desktop app on macOS. Setup details: Hoppscotch AIO deployed on Ubuntu VM via Docker. Application exposed through Nginx with SSL using self-signed certificates. The web app works perfectly with no certificate errors. The desktop app on macOS (idk on other OS) throws the same certificate trust error mentioned previously. On the macOS client: The self-signed CA certificate has been installed and trusted in the system keychain. The CA certificate file was also copied to /etc/ssl/cert.pem to cover low-level verification requirements. Despite these steps, the desktop app still fails to trust the self-signed certificate. Additionally, when curling the API endpoint directly against the server: bash `curl https://public-ip/desktop-app-server/api/v1/key` The response is: json `{"success":true,"data":{"key":"GmIIgfbUdlJZUQMVSeXsq8UsU7hXEHHKxWw0JnTROUE="}}` This confirms the server is reachable and responding correctly over HTTPS. Questions and suggestions: Does the desktop app use a different mechanism or bundle of trusted CAs compared to the system/browser? Could this be a limitation or bug in the desktop app’s certificate verification process on macOS? Any recommended best practices or workarounds for using self-signed certs with the Hoppscotch desktop app for self-signed certificates? Thanks for any guidance!

kerem commented

2026-03-16 23:14:08 +03:00

Author

Owner

@tnmyk commented on GitHub (Oct 26, 2025):

@lamicopalmato @silver886 Can you try adding the https URL (as well as http as shown in the docs) to the WHITELISTED_ORIGINS in .env.

https://docs.hoppscotch.io/documentation/clients/desktop#hoppscotch-self-hosted-edition-for-community

@tnmyk commented on GitHub (Oct 26, 2025): @lamicopalmato @silver886 Can you try adding the https URL (as well as http as shown in the docs) to the WHITELISTED_ORIGINS in .env. https://docs.hoppscotch.io/documentation/clients/desktop#hoppscotch-self-hosted-edition-for-community

kerem commented

2026-03-16 23:14:13 +03:00

Author

Owner

@Gum97 commented on GitHub (Oct 28, 2025):

same problem

@Gum97 commented on GitHub (Oct 28, 2025): same problem

kerem commented

2026-03-16 23:14:18 +03:00

Author

Owner

@lamicopalmato commented on GitHub (Oct 28, 2025):

same problem

I ran several configuration tests.

Deployment on local home network OK (without TLS)
Deployment on VPS KO (TLS self-signed and without TLS)
Deployment on VPS OK (TLS with good certificates)

@lamicopalmato commented on GitHub (Oct 28, 2025): > same problem I ran several configuration tests. 1) Deployment on local home network OK (without TLS) 2) Deployment on VPS KO (TLS self-signed and without TLS) 3) Deployment on VPS OK (TLS with good certificates)

kerem commented

2026-03-16 23:14:23 +03:00

Author

Owner

@Gum97 commented on GitHub (Oct 29, 2025):

same problem

I ran several configuration tests.

Deployment on local home network OK (without TLS)

Deployment on VPS KO (TLS self-signed and without TLS)

Deployment on VPS OK (TLS with good certificates)

i deploy vps docker AIO or containers for the services with nginx manager not OK. U can share docs deploy it

@Gum97 commented on GitHub (Oct 29, 2025): > > same problem > > I ran several configuration tests. > > 1. Deployment on local home network OK (without TLS) > 2. Deployment on VPS KO (TLS self-signed and without TLS) > 3. Deployment on VPS OK (TLS with good certificates) i deploy vps docker AIO or containers for the services with nginx manager not OK. U can share docs deploy it

kerem commented

2026-03-16 23:14:28 +03:00

Author

Owner

@silver886 commented on GitHub (Oct 30, 2025):

@tnmyk I followed this guide, https://docs.hoppscotch.io/documentation/self-host/community-edition/install-and-build#using-individual-containers-for-the-services.

WHITELISTED_ORIGINS=https://hoppscotch-api.mydomain.com,https://hoppscotch.mydomain.com,https://hoppscotch-admin.mydomain.com,https://hoppscotch-app.mydomain.com,app://hoppscotch,app://hoppscotch-app_mydomain_com,http://app.hoppscotch-app_mydomain_com is set and that doesn't work.

It's weird I can connect to my instance without TLS but not with TLS.

@silver886 commented on GitHub (Oct 30, 2025): @tnmyk I followed this guide, https://docs.hoppscotch.io/documentation/self-host/community-edition/install-and-build#using-individual-containers-for-the-services. `WHITELISTED_ORIGINS=https://hoppscotch-api.mydomain.com,https://hoppscotch.mydomain.com,https://hoppscotch-admin.mydomain.com,https://hoppscotch-app.mydomain.com,app://hoppscotch,app://hoppscotch-app_mydomain_com,http://app.hoppscotch-app_mydomain_com` is set and that doesn't work. It's weird I can connect to my instance without TLS but not with TLS.

kerem commented

2026-03-16 23:14:33 +03:00

Author

Owner

@SeoHyeonMyeong commented on GitHub (Dec 30, 2025):

Note: I'm Korean, so I used AI translation for this comment. Please excuse any awkward phrasing.

I managed to get this working after extensive troubleshooting. Here's the process for others facing similar issues:

Setup: Self-hosted Hoppscotch with Docker + Nginx reverse proxy

Problem: My TLS cert works fine with curl/Chrome but Safari rejects it (Apple policy: >398 days invalid, mine is 5-year). Since macOS desktop app uses Safari/WebKit, connection failed.

Solution steps:

Gave up on HTTPS, deployed with HTTP (http://mydomain.com:3111)
macOS app showed CORS errors. Checked dev tools (Cmd+Opt+I) and found weird origin header: http://mydomain_com_3111
Added to .env WHITELISTED_ORIGINS:
app://mydomain_com_3111,http://app.mydomain_com_3111
Still failed with ATS error (macOS blocks HTTP by default). Had to modify the app:

cp -r /Applications/Hoppscotch.app ~/Desktop/Hoppscotch.app
vi ~/Desktop/Hoppscotch.app/Contents/Info.plist
# Modified ATS policy to allow HTTP
cp -r ~/Desktop/Hoppscotch.app /Applications/

Results:
[success] macOS: works after ATS modification
[success] Windows: works after step 3 only
[failed] HTTPS: couldn't solve due to Apple cert restrictions

Key insight: desktop apps use unusual origin formats and macOS has stricter HTTP policies than Windows.

I learned that Safari performs much stricter TLS validation than Chrome/curl. Could someone test this in an HTTPS environment with a certificate that passes Safari's TLS validation?

@SeoHyeonMyeong commented on GitHub (Dec 30, 2025): Note: I'm Korean, so I used AI translation for this comment. Please excuse any awkward phrasing. I managed to get this working after extensive troubleshooting. Here's the process for others facing similar issues: Setup: Self-hosted Hoppscotch with Docker + Nginx reverse proxy Problem: My TLS cert works fine with curl/Chrome but Safari rejects it (Apple policy: >398 days invalid, mine is 5-year). Since macOS desktop app uses Safari/WebKit, connection failed. Solution steps: 1. Gave up on HTTPS, deployed with HTTP (`http://mydomain.com:3111`) 2. macOS app showed CORS errors. Checked dev tools (`Cmd+Opt+I`) and found weird origin header: `http://mydomain_com_3111` 3. Added to `.env` `WHITELISTED_ORIGINS`: `app://mydomain_com_3111,http://app.mydomain_com_3111` 4. Still failed with ATS error (macOS blocks HTTP by default). Had to modify the app: ``` cp -r /Applications/Hoppscotch.app ~/Desktop/Hoppscotch.app vi ~/Desktop/Hoppscotch.app/Contents/Info.plist # Modified ATS policy to allow HTTP cp -r ~/Desktop/Hoppscotch.app /Applications/ ``` Results: [success] macOS: works after ATS modification [success] Windows: works after step 3 only [failed] HTTPS: couldn't solve due to Apple cert restrictions Key insight: desktop apps use unusual origin formats and macOS has stricter HTTP policies than Windows. I learned that Safari performs much stricter TLS validation than Chrome/curl. Could someone test this in an HTTPS environment with a certificate that passes Safari's TLS validation?

kerem referenced this issue

2026-03-17 01:13:34 +03:00

[PR #2112] [CLOSED] build(deps-dev): bump @graphql-codegen/typescript from 2.4.2 to 2.4.3 #3626