fix(web): allow WebSocket connections from remote clients when --insecure is used#17440
Closed
shaase-ctrl wants to merge 1 commit into
Closed
fix(web): allow WebSocket connections from remote clients when --insecure is used#17440shaase-ctrl wants to merge 1 commit into
shaase-ctrl wants to merge 1 commit into
Conversation
…cure is used When using 'hermes dashboard --insecure --host 0.0.0.0', the HTTP page loads fine over Tailscale/remote connections, but the WebSocket endpoints (/api/pty, /api/ws, /api/pub, /api/events) still rejected non-loopback clients with code 4403 (Forbidden). This caused 'Session ended' errors in the Chat tab when accessing the dashboard remotely via Tailscale, even though --insecure was passed. The fix stores the allow_public flag in app.state and checks it before rejecting non-loopback WebSocket connections. The default behavior (loopback-only) remains unchanged for security. Fixes: WebSocket Chat tab not working over Tailscale with --insecure flag
This was referenced Apr 30, 2026
Contributor
|
Closing as already fixed on Triage notes (high confidence): If you still see this on the latest version, please reopen with reproduction steps. (Bulk-closed during a CLI triage sweep.) |
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When using
hermes dashboard --insecure --host 0.0.0.0, the HTTP page loads fine over Tailscale/remote connections, but the WebSocket endpoints (/api/pty,/api/ws,/api/pub,/api/events) still rejected non-loopback clients with code 4403 (Forbidden).This caused "Session ended" errors in the Chat tab when accessing the dashboard remotely via Tailscale, even though
--insecurewas passed.Root Cause
In
hermes_cli/web_server.py:allow_public: bool = Falseis set when--insecureis used_LOOPBACK_HOSTSunconditionallyallow_publicwas NOT stored inapp.statefor WebSocket handlers to checkFix
allow_publicinapp.stateinstart_server()(line 3158)app.state.allow_publicbefore rejecting non-loopback clients in all 4 WebSocket handlersChanges
app.state.allow_public = allow_publicinstart_server()pty_ws(),gateway_ws(),pub_ws(),events_ws()to skip the check whenallow_publicis TrueSecurity Note
This fix only affects connections when
--insecureis explicitly used. The default behavior (loopback-only) remains unchanged for security.Testing
Tested locally with
hermes dashboard --no-open --tui --host 0.0.0.0 --insecureover Tailscale - WebSocket Chat tab now works correctly from remote clients.