From 09e61904003f37a7263d271c96020104f23adbba Mon Sep 17 00:00:00 2001 From: Jiayuan Zhang Date: Tue, 14 Apr 2026 17:54:10 +0800 Subject: [PATCH] fix(cli): use localhost for CLI callback when app URL is a public hostname (#977) When `multica login` runs against production (multica.ai), the CLI was using the app URL hostname as the callback host, producing a callback URL like `http://multica.ai:PORT/callback`. This URL fails frontend validation (which only allows localhost and private IPs) and can't actually reach the CLI's local HTTP server. Now only private IPs (RFC 1918) are used as the callback host, which matches the intended self-hosted LAN scenario. Public hostnames correctly fall back to localhost. Fixes #974 --- server/cmd/multica/cmd_auth.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/server/cmd/multica/cmd_auth.go b/server/cmd/multica/cmd_auth.go index 41b939bcd..889d48c10 100644 --- a/server/cmd/multica/cmd_auth.go +++ b/server/cmd/multica/cmd_auth.go @@ -99,13 +99,16 @@ func runAuthLoginBrowser(cmd *cobra.Command) error { appURL := resolveAppURL(cmd) // Determine the callback host from the configured app URL. - // For self-hosted setups where the browser is on a different machine, - // we need to use the server's reachable hostname instead of localhost. + // For self-hosted setups where the browser is on a different machine + // (e.g. Multica running on a LAN server), use the server's private IP + // so the browser can reach the CLI's local HTTP server. + // For production (public hostnames like multica.ai), keep localhost — + // the browser and CLI are on the same machine. callbackHost := "localhost" bindAddr := "127.0.0.1" if parsed, err := url.Parse(appURL); err == nil { h := parsed.Hostname() - if h != "" && h != "localhost" && h != "127.0.0.1" { + if ip := net.ParseIP(h); ip != nil && ip.IsPrivate() { callbackHost = h bindAddr = "0.0.0.0" }