{"record":{"id":"991f2e435769fa0f","repo":"openai/codex","slug":"refusing-to-start-non-loopback-websocket-listener","errorCode":null,"errorMessage":"refusing to start non-loopback websocket listener {bind_address} without auth; configure `--ws-auth capability-token` or `--ws-auth signed-bearer-token`","messagePattern":"refusing to start non-loopback websocket listener (.+?) without auth; configure `--ws-auth capability-token` or `--ws-auth signed-bearer-token`","errorType":"validation","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/app-server-transport/src/transport/websocket.rs","lineNumber":136,"sourceCode":"    }\n    info!(%peer_addr, \"websocket client connected\");\n    websocket\n        .on_upgrade(move |stream| async move {\n            let (websocket_writer, websocket_reader) = stream.split();\n            run_websocket_connection(websocket_writer, websocket_reader, state.transport_event_tx)\n                .await;\n        })\n        .into_response()\n}\n\npub async fn start_websocket_acceptor(\n    bind_address: SocketAddr,\n    transport_event_tx: mpsc::Sender<TransportEvent>,\n    shutdown_token: CancellationToken,\n    auth_policy: WebsocketAuthPolicy,\n) -> IoResult<JoinHandle<()>> {\n    if is_unauthenticated_non_loopback_listener(bind_address, &auth_policy) {\n        return Err(std::io::Error::new(\n            std::io::ErrorKind::InvalidInput,\n            format!(\n                \"refusing to start non-loopback websocket listener {bind_address} without auth; configure `--ws-auth capability-token` or `--ws-auth signed-bearer-token`\"\n            ),\n        ));\n    }\n    let listener = TcpListener::bind(bind_address).await?;\n    let local_addr = listener.local_addr()?;\n    print_websocket_startup_banner(local_addr);\n    info!(\"app-server websocket listening on ws://{local_addr}\");\n\n    let router = Router::new()\n        .route(\"/readyz\", get(health_check_handler))\n        .route(\"/healthz\", get(health_check_handler))\n        .fallback(any(websocket_upgrade_handler))\n        .layer(middleware::from_fn(reject_requests_with_origin_header))\n        .with_state(WebSocketListenerState {\n            transport_event_tx,","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/app-server-transport/src/transport/websocket.rs#L118-L154","documentation":"Error \"refusing to start non-loopback websocket listener {bind_address} without auth; configure `--ws-auth capability-token` or `--ws-auth signed-bearer-token`\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/app-server-transport/src/transport/websocket.rs:136 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}