fix: localhost not loading by nams1570 · Pull Request #1122 · stack-auth/stack-auth

nams1570 · 2026-01-19T23:15:51Z

Summary of Changes

The recent push to main fixed the issue with localhost not loading, but only for next.js environments. We don't have a guarantee that the sdk will be loaded in an environment with access to process. So, we move away from using environment variables to check for test/dev environments. We allow it to be configured via the sdk and also check for localhost explicitly (sort of a heuristic for development env).

Summary by CodeRabbit

New Features
- Added optional configuration option to enable insecure HTTP requests for testing and development purposes (defaults to disabled for production safety).
Tests
- Added comprehensive test coverage for HTTP request security validation across localhost and non-localhost scenarios.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

vercel · 2026-01-19T23:15:55Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
stack-backend	Error		Jan 20, 2026 0:14am
stack-dashboard	Ready	Preview, Comment	Jan 20, 2026 0:14am
stack-demo	Ready	Preview, Comment	Jan 20, 2026 0:14am
stack-docs	Error		Jan 20, 2026 0:14am

coderabbitai · 2026-01-19T23:15:56Z

📝 Walkthrough

Walkthrough

This PR introduces a new dangerouslyAllowInsecureHttp configuration option to control insecure HTTP request handling. It centralizes localhost detection and HTTP allowance logic into a reusable shouldAllowInsecureRequest utility that always permits localhost HTTP but requires explicit opt-in for non-localhost HTTP. The option is threaded through client initialization layers.

Changes

Cohort / File(s)	Summary
HTTP Security Utility `packages/stack-shared/src/utils/http-security.tsx`	New utility function `shouldAllowInsecureRequest` that determines if HTTP requests should be allowed based on endpoint and opt-in flag; always allows localhost HTTP, conditionally allows non-localhost HTTP.
HTTP Security Tests `packages/stack-shared/src/utils/http-security.test.ts`	Comprehensive test suite covering localhost detection, HTTPS handling, opt-in flag behavior, and edge cases for the new utility.
Client Interface `packages/stack-shared/src/interface/client-interface.ts`	Replaces ad-hoc environment-based insecure HTTP logic with calls to `shouldAllowInsecureRequest`; adds `dangerouslyAllowInsecureHttp` option to `ClientInterfaceOptions`.
Client App Interface & Implementation `packages/template/src/lib/stack-app/apps/interfaces/client-app.ts`, `packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts`	Introduces `dangerouslyAllowInsecureHttp` option to public constructor options and threads it through to client initialization.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Possibly related PRs

fix sign in bug on dev #1119 — Both PRs modify insecure HTTP allowance logic in client-interface.ts, centralizing how allowInsecure is computed for token exchange and OAuth callbacks.

Suggested reviewers

N2D4

Poem

🐰 A flag to test with HTTP's might,
Localhost flows without a fight,
But venture forth to distant lands?
Only when danger's in your hands!
Centralized logic, clean and tight. 🔐

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'fix: localhost not loading' is vague and doesn't clearly convey the main change. The PR actually introduces a new configuration option for handling insecure HTTP requests and centralizes HTTP security logic, rather than simply 'fixing' localhost loading.	Consider a more specific title like 'feat: add dangerouslyAllowInsecureHttp option for HTTP security configuration' or 'refactor: centralize HTTP security checks and improve localhost handling' that better captures the substantive changes being made.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

localhost was not loading before the recent fix on dev because the env vars weren't pulled correctly. The recent fix is not enough because we have no guarantee that process will exist in the sdk environment. So we solve it without env vars. We explicitly check for localhost (simulating dev env), and allow the sdk to configure the feature. It is a default parameter so shouldn't be a breaking change.

greptile-apps · 2026-01-19T23:24:19Z

Greptile Summary

Replaced environment variable checks (process.env.NODE_ENV) with explicit configuration option and localhost detection to fix SDK loading issues in non-Node.js environments.

Introduced shouldAllowInsecureRequest() utility that detects localhost URLs via regex and accepts an explicit opt-in flag
Added dangerouslyAllowInsecureHttp option to client interface for test environments
Removed dependency on process.env which was unavailable in browser environments
Comprehensive test coverage for localhost detection and edge cases

Confidence Score: 4/5

This PR is safe to merge with low risk - it fixes a real issue and maintains security defaults
The changes properly address the environment variable issue and maintain security by defaulting to secure behavior. The one minor improvement suggested (IPv6 localhost support) is not critical for the current use case since tokenEndpoint is always constructed with a path.
No files require special attention - all changes are well-tested and straightforward

Important Files Changed

Filename	Overview
packages/stack-shared/src/utils/http-security.tsx	Added utility function to determine if insecure HTTP requests should be allowed, with localhost detection logic and opt-in flag support
packages/stack-shared/src/interface/client-interface.ts	Replaced `process.env` checks with the new `shouldAllowInsecureRequest` utility function and added `dangerouslyAllowInsecureHttp` option

Sequence Diagram

sequenceDiagram
    participant Client as Client App
    participant Interface as StackClientInterface
    participant Security as shouldAllowInsecureRequest()
    participant OAuth as OAuth Library
    
    Client->>Interface: Initialize with dangerouslyAllowInsecureHttp option
    Note over Client,Interface: Option defaults to false for security
    
    Interface->>Interface: Build tokenEndpoint URL
    Note over Interface: tokenEndpoint = getApiUrl() + '/auth/oauth/token'
    
    Interface->>Security: shouldAllowInsecureRequest(tokenEndpoint, option)
    
    alt tokenEndpoint matches localhost pattern
        Security->>Security: Check regex: /^http:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/
        Security-->>Interface: return true (localhost always allowed)
    else non-localhost HTTP with flag enabled
        Security->>Security: Check dangerouslyAllowInsecureHttp === true
        Security->>Security: Check endpoint.startsWith('http://')
        Security-->>Interface: return true (explicitly opted in)
    else non-localhost HTTP without flag
        Security-->>Interface: return false (blocked for security)
    else HTTPS endpoint
        Security-->>Interface: return false (no flag needed for HTTPS)
    end
    
    alt allowInsecure === true
        Interface->>OAuth: Call with {[allowInsecureRequests]: true}
    else allowInsecure === false
        Interface->>OAuth: Call without insecure flag
    end
    
    OAuth-->>Interface: Response
    Interface-->>Client: Complete request

greptile-apps

_{5 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

packages/stack-shared/src/utils/http-security.tsx

Copilot

Pull request overview

This PR fixes the localhost loading issue in non-Next.js environments by removing the dependency on process.env.NODE_ENV checks for HTTP security validation. Instead, it introduces a configurable dangerouslyAllowInsecureHttp option and implements localhost detection as a heuristic for development environments.

Changes:

Added dangerouslyAllowInsecureHttp configuration option to SDK with appropriate warnings
Replaced process.env.NODE_ENV checks with a dedicated shouldAllowInsecureRequest() utility function
Implemented localhost detection using regex to automatically allow HTTP for local development

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/template/src/lib/stack-app/apps/interfaces/client-app.ts	Added `dangerouslyAllowInsecureHttp` option to the SDK configuration interface
packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts	Passed the new option through to the StackClientInterface with a default value of false
packages/stack-shared/src/utils/http-security.tsx	Created new utility function to determine if insecure HTTP requests should be allowed based on localhost detection and configuration
packages/stack-shared/src/utils/http-security.test.ts	Added comprehensive test coverage for the new security utility function
packages/stack-shared/src/interface/client-interface.ts	Replaced `process.env` checks with the new `shouldAllowInsecureRequest()` function in OAuth token endpoints

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/stack-shared/src/utils/http-security.tsx

packages/stack-shared/src/utils/http-security.test.ts

packages/stack-shared/src/utils/http-security.tsx

N2D4

this is quite overengineered. there is nothing dangerous about allowing insecure HTTP connections here as the tokenEndpoint is under our own control

N2D4 · 2026-01-20T00:16:04Z

packages/stack-shared/src/interface/client-interface.ts

+  /**
+   * Allows HTTP (non-HTTPS) requests to non-localhost servers.
+   * WARNING: Only use this for testing environments. Never enable in production.
+   * @default false
+   */
+  dangerouslyAllowInsecureHttp?: boolean,


it's not that dangerous. it would still require us to have an HTTP base url... which we'd never do in production

keep in mind, tokenEndpoint is controlled by us, not an attacker

Suggested change

/**

* Allows HTTP (non-HTTPS) requests to non-localhost servers.

* WARNING: Only use this for testing environments. Never enable in production.

* @default false

*/

dangerouslyAllowInsecureHttp?: boolean,

github-actions bot assigned nams1570 Jan 19, 2026

nams1570 force-pushed the fix-oauth-env-pull branch from b873f17 to fb0ca7d Compare January 19, 2026 23:19

nams1570 marked this pull request as ready for review January 19, 2026 23:21

Copilot AI review requested due to automatic review settings January 19, 2026 23:21

Copilot started reviewing on behalf of nams1570 January 19, 2026 23:22 View session

greptile-apps bot reviewed Jan 19, 2026

View reviewed changes

packages/stack-shared/src/utils/http-security.tsx Show resolved Hide resolved

nams1570 requested a review from BilalG1 January 19, 2026 23:24

Copilot AI reviewed Jan 19, 2026

View reviewed changes

BilalG1 approved these changes Jan 19, 2026

View reviewed changes

nams1570 added 2 commits January 19, 2026 16:01

Merge branch 'dev' into fix-oauth-env-pull

4bc31d6

Merge branch 'dev' into fix-oauth-env-pull

99ed7b5

N2D4 requested changes Jan 20, 2026

View reviewed changes

N2D4 reviewed Jan 20, 2026

View reviewed changes

N2D4 closed this in 52668d7 Jan 20, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: localhost not loading#1122

fix: localhost not loading#1122
nams1570 wants to merge 3 commits intodevfrom
fix-oauth-env-pull

nams1570 commented Jan 19, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

vercel bot commented Jan 19, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Jan 19, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

greptile-apps bot commented Jan 19, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

N2D4 left a comment

Uh oh!

N2D4 Jan 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

nams1570 commented Jan 19, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of Changes

Summary by CodeRabbit

Uh oh!

vercel bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

greptile-apps bot commented Jan 19, 2026

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

N2D4 left a comment

Choose a reason for hiding this comment

Uh oh!

N2D4 Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nams1570 commented Jan 19, 2026 •

edited by coderabbitai bot

Loading

vercel bot commented Jan 19, 2026 •

edited

Loading

coderabbitai bot commented Jan 19, 2026 •

edited

Loading

N2D4 Jan 20, 2026 •

edited

Loading