starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #5737] [bug]: Errors with Desktop Import - Auth Flow - CORs - AIO Nightmare #2240

New issue

Open

opened 2026-03-16 23:41:44 +03:00 by kerem · 6 comments

kerem commented

2026-03-16 23:41:44 +03:00

Owner

Originally created by @FreeSoftwareServers on GitHub (Dec 29, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5737

Originally assigned to: @CuriousCorrelation on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Platform

Web App

Browser

Chrome

Operating System

Windows

Bug Description

I spent a good day messing with installing this software and it's sort of works, but still a number of issues that will have to be resolved before adoption.

Issues:

My backend Admin dash does not pickup configs in the ".env".
The Desktop App times out downloading bundle
I constantly get "/backend/v1/auth/refresh" 403 Forbidden
Backend:
hoppscotch | Webapp Server | 2025/12/29 13:01:33 Successfully sent bundle for download (size: 31700389 bytes)
DesktopApp:

[InstanceService] Connection failed: Failed to download instance: Error: Connection timeout after 30000ms
30000ms
  {
    "bundleName": "Hoppscotch",
    "displayName": "Hoppscotch Desktop",
    "kind": "vendored",
    "lastUsed": "2025-12-29T04:19:35.172Z",
    "serverUrl": "app://hoppscotch",
    "version": "25.12.0"
  }
]

I'm using Cloudflare as a proxy/SSL termination and docker to host software.

Here is compose:

services:
  hoppscotch:
    image: hoppscotch/hoppscotch
    container_name: hoppscotch
    hostname: hoppscotch
    command: sh -c "pnpx prisma migrate deploy && node /usr/src/app/aio_run.mjs"
    networks:
      - hoppscotch_net
    restart: unless-stopped
    ports:
      - "3200:3200"	#Bundler 	/desktop-app-server 	#This never changes and requires separate proxy
      - "5000:5000"	#Subpath                        #This gets EVERYTHING if SUBPATH is TRUE, single proxy point
    volumes:
      - type: bind
        read_only: true
        source: /etc/localtime
        target: /etc/localtime
    env_file:
      - ./.env
    depends_on:
      hoppscotch_db:
        condition: service_healthy

  hoppscotch_db:
    image: 'postgres:15-alpine'
    container_name: hoppscotch_db
    hostname: hoppscotch_db
    networks:
      - hoppscotch_net
    ports:
      - '5432:5432'
    volumes:
      - type: bind
        read_only: true
        source: /etc/localtime
        target: /etc/localtime
      - type: bind
        source: /opt/hoppscotch/db/
        target: /var/lib/postgresql/data
        bind:
          create_host_path: true
    environment:
      - 'POSTGRES_USER=${DB_USER}'
      - 'POSTGRES_PASSWORD=${DB_PASS}'
      - 'POSTGRES_DB=${DB_NAME}'
    healthcheck:
      test:
        - CMD-SHELL
        - 'sh -c ''pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}'''
      interval: 5s
      timeout: 5s
      retries: 10
      
networks:
  hoppscotch_net:
    driver: bridge

Here is ENV:

#-----------------------Global Config------------------------------#
#Note Unable to access Backend/Error 405 USE CTRL + F5 to refresh sometimes after changing these values/restart stack

#HTTPS
URL=hoppscotch.example.com
HTTPS_BOOL=true
HTTP_METH=https
WS_METH=wss #ws for http, wss for https

#HTTP
#URL=192.168.1.255:5000
#HTTPS_BOOL=false
#HTTP_METH=http
#WS_METH=ws #ws for http, wss for https

# Sensitive Data Encryption Key while storing in Database (32 character)
# This one is glitchy, can't be wrapped in "" according to some sources
# head -c 32 /dev/urandom | base64 | cut -c 1-32
DATA_ENCRYPTION_KEY=LongStringWithSpecialChars!@#1234567890AndNoQuotes
JWT_SECRET=LongStringWithSpecialChars!@#1234567890AndNoQuotes
SESSION_SECRET=LongStringWithSpecialChars!@#1234567890AndNoQuotes

REDIRECT_URL=${HTTP_METH}://${URL}
#-----------------------Auth Config------------------------------#
# Not sure how needed Auth is for private instances, as I was able to get to root URL, just not access "/admin" or create an account without these being set
# All I saw once logged in where some options I didn't need TBH
# 
# For more info on choosing OAuth providers, visit:
# https://docs.hoppscotch.io/documentation/self-host/community-edition/prerequisites#choosing-oauth-providers
# VITE_ALLOWED_AUTH_PROVIDERS=GOOGLE,GITHUB,MICROSOFT,EMAIL
# 
VITE_ALLOWED_AUTH_PROVIDERS=GITHUB
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_CALLBACK_URL=${REDIRECT_URL}/backend/v1/auth/github/callback
GITHUB_SCOPE=user:email

#-----------------------Backend Config------------------------------#
# Prisma Config
DB_USER=hoppscotch
DB_PASS=hoppscotch
DB_NAME=hoppscotch
DATABASE_URL=postgresql://hoppscotch:${DB_PASS}@hoppscotch_db:5432/hoppscotch

# Auth Tokens Config
TOKEN_SALT_COMPLEXITY=10
MAGIC_LINK_TOKEN_VALIDITY=3
# Default validity is 7 days (604800000 ms) in ms
REFRESH_TOKEN_VALIDITY=604800000
# Default validity is 1 day (86400000 ms) in ms
ACCESS_TOKEN_VALIDITY=86400000

# Recommended to be true, set to false if you are using http
# Note: Some auth providers may not support http requests
ALLOW_SECURE_COOKIES=${HTTPS_BOOL}

# Hoppscotch App Domain Config
WHITELISTED_ORIGINS=http://localhost:3170,http://localhost:3000,http://localhost:3100,app://localhost_3200,app://hoppscotch,app://${URL},app://${URL}_3200,${REDIRECT_URL},http://localhost:5000
#WHITELISTED_ORIGINS=app://hoppscotch,app://${URL},app://${URL}_3200,${REDIRECT_URL}

# Rate Limit Config
RATE_LIMIT_TTL=60 # In seconds
RATE_LIMIT_MAX=100 # Max requests per IP

#-----------------------Frontend Config------------------------------#

# Base URLs
VITE_BASE_URL=${REDIRECT_URL}
VITE_SHORTCODE_BASE_URL=${REDIRECT_URL}
#AIO Admin URL requires /admin
VITE_ADMIN_URL=${REDIRECT_URL}/admin

# Backend URLs # sometimes get ignored, refresh with Ctrl+F5 to fix
# /backend/ REQ for AIO Container
VITE_BACKEND_GQL_URL=${REDIRECT_URL}/backend/graphql
VITE_BACKEND_WS_URL=${WS_METH}://${URL}/backend/graphql
VITE_BACKEND_API_URL=${REDIRECT_URL}/backend/v1

# Terms Of Service And Privacy Policy Links (Optional)
VITE_APP_TOS_LINK=https://docs.hoppscotch.io/support/terms
VITE_APP_PRIVACY_POLICY_LINK=https://docs.hoppscotch.io/support/privacy

# Set to `true` for subpath based access #Req for AIO Container which is NEW Standard they are pushing, but not in docs
ENABLE_SUBPATH_BASED_ACCESS=true
# (Optional) By default, the AIO container (when in subpath access mode) exposes the endpoint on port 80. Use this setting to specify a different port if needed.
# Default port of 80 inside container can't be used for HTTPS
HOPP_AIO_ALTERNATE_PORT=5000

Do you see anything wrong?

My proxies are pretty straightforward w/ CF, I have on for hoppscotch.example.com which goes to 5000 and another for hoppscotch.example.com/desktop-app-server to 3200.

Deployment Type

Self-hosted (on-prem deployment)

Version

latest as of 12/29/25

Originally created by @FreeSoftwareServers on GitHub (Dec 29, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5737 Originally assigned to: @CuriousCorrelation on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Platform Web App ### Browser Chrome ### Operating System Windows ### Bug Description I spent a good day messing with installing this software and it's sort of works, but still a number of issues that will have to be resolved before adoption. Issues: * My backend Admin dash does not pickup configs in the ".env". * The Desktop App times out downloading bundle * I constantly get "/backend/v1/auth/refresh" 403 Forbidden Backend: `hoppscotch | Webapp Server | 2025/12/29 13:01:33 Successfully sent bundle for download (size: 31700389 bytes)` DesktopApp: ``` [InstanceService] Connection failed: Failed to download instance: Error: Connection timeout after 30000ms 30000ms { "bundleName": "Hoppscotch", "displayName": "Hoppscotch Desktop", "kind": "vendored", "lastUsed": "2025-12-29T04:19:35.172Z", "serverUrl": "app://hoppscotch", "version": "25.12.0" } ] ``` I'm using Cloudflare as a proxy/SSL termination and docker to host software. Here is compose: ``` services: hoppscotch: image: hoppscotch/hoppscotch container_name: hoppscotch hostname: hoppscotch command: sh -c "pnpx prisma migrate deploy && node /usr/src/app/aio_run.mjs" networks: - hoppscotch_net restart: unless-stopped ports: - "3200:3200" #Bundler /desktop-app-server #This never changes and requires separate proxy - "5000:5000" #Subpath #This gets EVERYTHING if SUBPATH is TRUE, single proxy point volumes: - type: bind read_only: true source: /etc/localtime target: /etc/localtime env_file: - ./.env depends_on: hoppscotch_db: condition: service_healthy hoppscotch_db: image: 'postgres:15-alpine' container_name: hoppscotch_db hostname: hoppscotch_db networks: - hoppscotch_net ports: - '5432:5432' volumes: - type: bind read_only: true source: /etc/localtime target: /etc/localtime - type: bind source: /opt/hoppscotch/db/ target: /var/lib/postgresql/data bind: create_host_path: true environment: - 'POSTGRES_USER=${DB_USER}' - 'POSTGRES_PASSWORD=${DB_PASS}' - 'POSTGRES_DB=${DB_NAME}' healthcheck: test: - CMD-SHELL - 'sh -c ''pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}''' interval: 5s timeout: 5s retries: 10 networks: hoppscotch_net: driver: bridge ``` Here is ENV: ``` #-----------------------Global Config------------------------------# #Note Unable to access Backend/Error 405 USE CTRL + F5 to refresh sometimes after changing these values/restart stack #HTTPS URL=hoppscotch.example.com HTTPS_BOOL=true HTTP_METH=https WS_METH=wss #ws for http, wss for https #HTTP #URL=192.168.1.255:5000 #HTTPS_BOOL=false #HTTP_METH=http #WS_METH=ws #ws for http, wss for https # Sensitive Data Encryption Key while storing in Database (32 character) # This one is glitchy, can't be wrapped in "" according to some sources # head -c 32 /dev/urandom | base64 | cut -c 1-32 DATA_ENCRYPTION_KEY=LongStringWithSpecialChars!@#1234567890AndNoQuotes JWT_SECRET=LongStringWithSpecialChars!@#1234567890AndNoQuotes SESSION_SECRET=LongStringWithSpecialChars!@#1234567890AndNoQuotes REDIRECT_URL=${HTTP_METH}://${URL} #-----------------------Auth Config------------------------------# # Not sure how needed Auth is for private instances, as I was able to get to root URL, just not access "/admin" or create an account without these being set # All I saw once logged in where some options I didn't need TBH # # For more info on choosing OAuth providers, visit: # https://docs.hoppscotch.io/documentation/self-host/community-edition/prerequisites#choosing-oauth-providers # VITE_ALLOWED_AUTH_PROVIDERS=GOOGLE,GITHUB,MICROSOFT,EMAIL # VITE_ALLOWED_AUTH_PROVIDERS=GITHUB GITHUB_CLIENT_ID= GITHUB_CLIENT_SECRET= GITHUB_CALLBACK_URL=${REDIRECT_URL}/backend/v1/auth/github/callback GITHUB_SCOPE=user:email #-----------------------Backend Config------------------------------# # Prisma Config DB_USER=hoppscotch DB_PASS=hoppscotch DB_NAME=hoppscotch DATABASE_URL=postgresql://hoppscotch:${DB_PASS}@hoppscotch_db:5432/hoppscotch # Auth Tokens Config TOKEN_SALT_COMPLEXITY=10 MAGIC_LINK_TOKEN_VALIDITY=3 # Default validity is 7 days (604800000 ms) in ms REFRESH_TOKEN_VALIDITY=604800000 # Default validity is 1 day (86400000 ms) in ms ACCESS_TOKEN_VALIDITY=86400000 # Recommended to be true, set to false if you are using http # Note: Some auth providers may not support http requests ALLOW_SECURE_COOKIES=${HTTPS_BOOL} # Hoppscotch App Domain Config WHITELISTED_ORIGINS=http://localhost:3170,http://localhost:3000,http://localhost:3100,app://localhost_3200,app://hoppscotch,app://${URL},app://${URL}_3200,${REDIRECT_URL},http://localhost:5000 #WHITELISTED_ORIGINS=app://hoppscotch,app://${URL},app://${URL}_3200,${REDIRECT_URL} # Rate Limit Config RATE_LIMIT_TTL=60 # In seconds RATE_LIMIT_MAX=100 # Max requests per IP #-----------------------Frontend Config------------------------------# # Base URLs VITE_BASE_URL=${REDIRECT_URL} VITE_SHORTCODE_BASE_URL=${REDIRECT_URL} #AIO Admin URL requires /admin VITE_ADMIN_URL=${REDIRECT_URL}/admin # Backend URLs # sometimes get ignored, refresh with Ctrl+F5 to fix # /backend/ REQ for AIO Container VITE_BACKEND_GQL_URL=${REDIRECT_URL}/backend/graphql VITE_BACKEND_WS_URL=${WS_METH}://${URL}/backend/graphql VITE_BACKEND_API_URL=${REDIRECT_URL}/backend/v1 # Terms Of Service And Privacy Policy Links (Optional) VITE_APP_TOS_LINK=https://docs.hoppscotch.io/support/terms VITE_APP_PRIVACY_POLICY_LINK=https://docs.hoppscotch.io/support/privacy # Set to `true` for subpath based access #Req for AIO Container which is NEW Standard they are pushing, but not in docs ENABLE_SUBPATH_BASED_ACCESS=true # (Optional) By default, the AIO container (when in subpath access mode) exposes the endpoint on port 80. Use this setting to specify a different port if needed. # Default port of 80 inside container can't be used for HTTPS HOPP_AIO_ALTERNATE_PORT=5000 ``` Do you see anything wrong? My proxies are pretty straightforward w/ CF, I have on for hoppscotch.example.com which goes to 5000 and another for hoppscotch.example.com/desktop-app-server to 3200. ### Deployment Type Self-hosted (on-prem deployment) ### Version latest as of 12/29/25

kerem added the

bug

need testing

labels

2026-03-16 23:41:44 +03:00

kerem commented

2026-03-16 23:41:56 +03:00

Author

Owner

@FreeSoftwareServers commented on GitHub (Dec 29, 2025):

Ok, so first issue mostly resolved, except the env isn't picking up variables, but I did get auth working by using backend/ inside the auth call back. I also had to turn off ALLOW_SECURE_COOKIES=true even though I am loading via SSL....
I now was able to get the app to sync to backend, but I am getting CORs issues... Looks like I need to whitelist:
'http://app.hoppscotch_example_com' even though I have no "app" subdomain configured, this should be documented, but should be easy to resolve. The final issue is that the "graphql" is failing.... Will keep plugging away. Overall the app looks great, just, the docs/setup is a nightmare.

@FreeSoftwareServers commented on GitHub (Dec 29, 2025): Ok, so first issue mostly resolved, except the env isn't picking up variables, but I did get auth working by using `backend/` inside the auth call back. I also had to turn off `ALLOW_SECURE_COOKIES=true` even though I am loading via SSL.... I now was able to get the app to sync to backend, but I am getting CORs issues... Looks like I need to whitelist: 'http://app.hoppscotch_example_com' even though I have no "app" subdomain configured, this should be documented, but should be easy to resolve. The final issue is that the "graphql" is failing.... Will keep plugging away. Overall the app looks great, just, the docs/setup is a nightmare.

kerem commented

2026-03-16 23:42:01 +03:00

Author

Owner

@FreeSoftwareServers commented on GitHub (Dec 29, 2025):

So whitelisting the http://app. resolved CORs and not sure if that resolved graphql, but it's working now. I tested in incognito mode and it worked, but in regular browser failed, even with CTRL F5, had to clear cookies/data and now it works.
Final issue(s):
Admin dash should pickup env vars...
wss:// failing.
It appears as though you are pushing users towards AIO, but docs don't reflect that and AIO seems to have a lot of routing issues and caching issues.

@FreeSoftwareServers commented on GitHub (Dec 29, 2025): So whitelisting the http://app. resolved CORs and not sure if that resolved graphql, but it's working now. I tested in incognito mode and it worked, but in regular browser failed, even with CTRL F5, had to clear cookies/data and now it works. Final issue(s): Admin dash should pickup env vars... wss:// failing. It appears as though you are pushing users towards AIO, but docs don't reflect that and AIO seems to have a lot of routing issues and caching issues.

kerem commented

2026-03-16 23:42:06 +03:00

Author

Owner

@FreeSoftwareServers commented on GitHub (Dec 29, 2025):

So more weirdness, turns our GraphQL works if I don't sign in, if I do, it breaks, and then the only fix is sign out + hard refresh. Thankfully, I can put everything behind Cloudflare OIDC and just have no auth for this personal instance.
Looks like I will be the only user and backup via DB tars likely. I need to get moving testing API and stop messing with this project lol. Too bad, it really is well polished, but the separate vs AIO and routing issues are a nightmare. WAY to many config options in environment IMO for URLs/Ports etc.

@FreeSoftwareServers commented on GitHub (Dec 29, 2025): So more weirdness, turns our GraphQL works if I don't sign in, if I do, it breaks, and then the only fix is sign out + hard refresh. Thankfully, I can put everything behind Cloudflare OIDC and just have no auth for this personal instance. Looks like I will be the only user and backup via DB tars likely. I need to get moving testing API and stop messing with this project lol. Too bad, it really is well polished, but the separate vs AIO and routing issues are a nightmare. WAY to many config options in environment IMO for URLs/Ports etc.

kerem commented

2026-03-16 23:42:11 +03:00

Author

Owner

@SeoHyeonMyeong commented on GitHub (Dec 30, 2025):

I experienced a similar issue. Even after changing the VITE_BACKEND_GQL_URL value in the .env file, it wasn't applied until I refreshed the cache and reloaded.

It was resolved after disabling Service Workers in Developer Tools > Application > Service Workers and clearing Site data in Storage.

@SeoHyeonMyeong commented on GitHub (Dec 30, 2025): I experienced a similar issue. Even after changing the `VITE_BACKEND_GQL_URL` value in the `.env` file, it wasn't applied until I refreshed the cache and reloaded. It was resolved after disabling Service Workers in Developer Tools > Application > Service Workers and clearing Site data in Storage.

kerem commented

2026-03-16 23:42:16 +03:00

Author

Owner

@FreeSoftwareServers commented on GitHub (Dec 30, 2025):

Honestly I sort of given up but it's hard for me to do I'll try tomorrow... I did just find a new piece of software that looks pretty promising though called Voiden that I'm pretty excited to give a good try!

https://voiden.md/

@FreeSoftwareServers commented on GitHub (Dec 30, 2025): Honestly I sort of given up but it's hard for me to do I'll try tomorrow... I did just find a new piece of software that looks pretty promising though called Voiden that I'm pretty excited to give a good try! https://voiden.md/

kerem commented

2026-03-16 23:42:21 +03:00

Author

Owner

@d1hr2uv commented on GitHub (Jan 14, 2026):

Thanks for the endorsement.

@d1hr2uv commented on GitHub (Jan 14, 2026): Thanks for the endorsement.

kerem referenced this issue

2026-03-17 01:16:51 +03:00

[PR #2240] [MERGED] refactor: realtime log entry revamp #3689

kerem referenced this issue

2026-03-17 01:19:02 +03:00