[GH-ISSUE #5192] Dashboard fetch fails with "Request cannot be constructed from a URL that includes credentials" when accessing via Basic Auth in URL

gitea-mirror commented

2026-05-05 14:34:11 -06:00

Owner

Originally created by @richex-cn on GitHub (Mar 4, 2026).
Original GitHub issue: https://github.com/fatedier/frp/issues/5192

Bug Description

When accessing the frp dashboard using a URL that includes HTTP Basic Auth credentials directly (e.g. https://user:password@yourdomain.com:7500/), the dashboard frontend fails to load server info.
A browser console error appears:

Failed to execute 'fetch' on 'Window': Request cannot be constructed from a URL that includes credentials: ../api/serverinfo

After this error, a popup shows: "Get server info from frps failed!"

If I remove the user:password@ part from the URL and let the browser prompt for credentials, everything works normally.

Expected behavior

The dashboard should load normally even when credentials are provided in the URL (many users bookmark such URLs for quick access without repeated login prompts).

Environment

Browser: Chrome 145

Additional context

This is a browser security restriction: modern browsers forbid constructing fetch() requests from a URL that contains embedded credentials (username:password@) for security reasons (URL leaking, logging, etc.).

Thanks for this great tool!

frpc Version

0.67.0

frps Version

0.67.0

System Architecture

windows/amd64

Configurations

# frps.toml
bindPort = 7000

auth.token = "123456"

webServer.addr = "0.0.0.0"
webServer.port = 7500
webServer.user = "admin"
webServer.password = "123456"
webServer.pprofEnable = false

Logs

No response

Steps to reproduce

Configure frps with dashboard enabled and HTTP Basic Auth
Access the dashboard using a convenience URL with credentials embedded:
https://admin:yourpass@dashboard.example.com:7500/
Dashboard shows error popup.

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @richex-cn on GitHub (Mar 4, 2026). Original GitHub issue: https://github.com/fatedier/frp/issues/5192 ### Bug Description When accessing the frp dashboard using a URL that includes HTTP Basic Auth credentials directly (e.g. `https://user:password@yourdomain.com:7500/`), the dashboard frontend fails to load server info. A browser console error appears: ``` Failed to execute 'fetch' on 'Window': Request cannot be constructed from a URL that includes credentials: ../api/serverinfo ``` After this error, a popup shows: **"Get server info from frps failed!"** If I remove the `user:password@` part from the URL and let the browser prompt for credentials, everything works normally. <img width="606" height="140" alt="Image" src="https://github.com/user-attachments/assets/7f0e1229-ef3d-40f5-95fd-0b0d4a6fd7d3" /> ### Expected behavior The dashboard should load normally even when credentials are provided in the URL (many users bookmark such URLs for quick access without repeated login prompts). ### Environment - Browser: Chrome 145 ### Additional context This is a browser security restriction: modern browsers forbid constructing `fetch()` requests from a URL that contains embedded credentials (username:password@) for security reasons (URL leaking, logging, etc.). Thanks for this great tool! ### frpc Version 0.67.0 ### frps Version 0.67.0 ### System Architecture windows/amd64 ### Configurations ``` # frps.toml bindPort = 7000 auth.token = "123456" webServer.addr = "0.0.0.0" webServer.port = 7500 webServer.user = "admin" webServer.password = "123456" webServer.pprofEnable = false ``` ### Logs _No response_ ### Steps to reproduce 1. Configure frps with dashboard enabled and HTTP Basic Auth 2. Access the dashboard using a convenience URL with credentials embedded: `https://admin:yourpass@dashboard.example.com:7500/` 3. Dashboard shows error popup. ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [x] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 14:34:11 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 14:34:14 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Mar 19, 2026):

Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Mar 19, 2026): Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.

gitea-mirror commented

2026-05-05 14:34:15 -06:00

Author

Owner

@fatedier commented on GitHub (Mar 20, 2026):

This is a browser security restriction — modern browsers block fetch() from URLs with embedded credentials (user:password@host). This is not something frp can or should work around. Please access the dashboard without credentials in the URL and let the browser prompt for authentication instead.

@fatedier commented on GitHub (Mar 20, 2026): This is a browser security restriction — modern browsers block fetch() from URLs with embedded credentials (user:password@host). This is not something frp can or should work around. Please access the dashboard without credentials in the URL and let the browser prompt for authentication instead.

gitea-mirror referenced this issue

2026-05-05 14:50:54 -06:00

[PR #4054] [MERGED] use new log package #4900