Okta sign-in fails inside the built-in browser. Every factor, including password, stops at "Okta FastPass requires network permission" (#9724, three independent reports on macOS).
Browser tabs can already reach 127.0.0.1. Electron never asks the preview session for permission before a loopback request. But the session's check handler answers denied for loopback-network, so navigator.permissions.query reports a block that does not exist. Okta's sign-in widget reads that state before it contacts Okta Verify, and gives up.
Repro: open any Okta tenant with FastPass in a browser tab, with Okta Verify running.
Add loopback-network to the preview permission allowlist, so the check handler matches what the browser already does.
| 1 | const ALLOWED_PREVIEW_PERMISSIONS = new Set([ |
| 2 | "clipboard-read", |
| 3 | "clipboard-sanitized-write", |
| 4 | "geolocation", |
| 5 | "fullscreen", |
| 6 | + // Electron 44 does not gate loopback requests behind this permission ... |
| 7 | + "loopback-network", |
| 8 | ]); |
local-network (other devices on the LAN) stays denied. The legacy local-network-access name also stays denied, because Okta only falls back to it when the loopback-network query throws, and Chromium 152 supports loopback-network.
Fixes #9724, which is not triaged yet. I think this qualifies as a small fix for an obvious bug. The permission check contradicts the browser's actual behavior, and the fix is one allowlist entry that makes it truthful. Pages gain no new network access, since loopback requests already succeed. If a future Electron starts enforcing loopback access through the request handler, tabs keep today's behavior because the same allowlist answers both handlers.
A per-site prompt, which commenters on #9724 suggested, would be a new feature and is out of scope.
Permission state vs. real behavior. Electron 44.9.3 / Chromium 152.0.7977.167 (the version main pins), a fresh partition with the preview handlers, public page https://example.com, request to a local 127.0.0.1 server:
loopback-network | local-network | fetch("http://127.0.0.1:ā¦") | |
|---|---|---|---|
| main | denied | denied | 200 |
| this branch | granted | denied | 200 |
The request handler was never called in either run.
Okta, end to end. macOS, vp run dev:desktop from this branch, no --disable-features flags, a real Okta tenant with FastPass:
| Before (nightly) | After (this branch) |
|---|---|
| Okta: FastPass requires network permission | Okta: Verifying your identity with Okta Verify |
DevTools on the Okta page in the tab (ā® ā Open DevTools):
| 1 | loopback-network granted |
| 2 | local-network denied |
Unit test. BrowserSession.test.ts now asserts that both handlers allow loopback-network and deny local-network and local-network-access. vp test run apps/desktop/src/preview/BrowserSession.test.ts passes 7/7. With the source line reverted, it fails with request handler should allow loopback-network.
vp lint, vp fmt --check, git diff --check and vp run --filter @t3tools/desktop typecheck are clean.
Not checked: Windows and Linux, and loopback SSO helpers other than Okta Verify. The manual Okta run used this change on an older main. After rebasing, the source change is identical and the unit test, lint and typecheck were rerun.
š¤ Generated with Claude Code using Claude Opus 5.5
Review completed
Added 1 commit
Verdict: Needs Human Approval
Macroscope's review found this PR requires human approval ā This fix broadens the default permission allowlist for every desktop preview session, changing both permission queries and request decisions for loopback access. The current Electron behavior and LAN denials are tested, but the default and authentication-related runtime behavior warrants human review.
You can add or adjust custom eligibility rules. Learn more.
Important
Review was skipped as selected files did not have any reviewable changes.
0e071797-b27a-404a-85b6-d2b2fdf7b2c6Reviewing files that changed from the base of the PR and between aa91fc99dfd062d72bb79d3953d8100a8d602b2b and 5f19a01a81fe8d347286d7f75c893400591bfb77.
You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.
Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. š
bf612709-6c20-414e-8d00-e82a4c56aea8Reviewing files that changed from the base of the PR and between 96f09c6558b098f05ad0c027afa3846209c03d4f and aa91fc99dfd062d72bb79d3953d8100a8d602b2b.
apps/desktop/src/preview/BrowserSession.test.tsapps/desktop/src/preview/BrowserSession.tsIncluded review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.
The preview permission allowlist now includes loopback-network. Tests expect loopback access to be granted and local-network and local-network-access to be denied.
Changes: Preview permissions
| Layer / File(s) | Summary |
|---|---|
Update preview permission handling apps/desktop/src/preview/BrowserSession.ts, apps/desktop/src/preview/BrowserSession.test.ts | The permission allowlist includes loopback-network. Tests verify that it is granted while local-network and local-network-access are denied. |
Priority: ā Normal
Estimated code review effort: 2 (Simple) | ~8 minutes
Change: Bug fix
Suggested reviewers: fixfon, juliusmarminge
aa91fThe permission change is limited to loopback access and the supplied tests cover the intended allow/deny behavior.
| Check name | Status | Explanation |
|---|---|---|
| Title check | Passed | The title clearly and concisely describes the primary fix: browser tabs no longer report loopback access as denied. |
| Linked Issues check | Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | Passed | Check skipped because no linked issues were found for this pull request. |
| Description check | Passed | The description covers the problem, change, scope and approval rationale, and verification. It includes reproduction context, test results, screenshots for the UI behavior, and untested platforms and ā¦ |
Explanation
The description covers the problem, change, scope and approval rationale, and verification. It includes reproduction context, test results, screenshots for the UI behavior, and untested platforms and scenarios.
Comment @coderabbitai help to get the list of available commands.