siyuan-note/siyuan · error

Desktop OIDC login requires a loopback listener

Error message

Desktop OIDC login requires a loopback listener

What it means

Returned by effectiveOIDCRedirectURL (kernel/model/oidc.go:605) for the desktop flow when the incoming request is not local (IsLocalRequest(c) is false) and the flow is not the web flow. The desktop OIDC login relies on a loopback listener on the kernel host; a non-local requester cannot reach that listener, so the redirect URL cannot be constructed.

Source

Thrown at kernel/model/oidc.go:605

		return nil
	}
	if requireRemoteRedirect {
		if _, err := validatePublicOIDCRedirectURL(config.RedirectURL); err != nil {
			return err
		}
	}
	return ValidateOIDCProviderConfiguration(ctx, config)
}

func effectiveOIDCRedirectURL(c *gin.Context, flow string) (string, error) {
	if flow == oidcFlowMobile {
		return oidcMobileRedirectURL, nil
	}
	if flow == oidcFlowWeb && !IsLocalRequest(c) {
		return validatePublicOIDCRedirectURL(Conf.GetOIDC().RedirectURL)
	}
	if !IsLocalRequest(c) {
		return "", errors.New("Desktop OIDC login requires a loopback listener")
	}
	scheme := "http"
	if c.Request.TLS != nil || c.GetHeader("X-Forwarded-Proto") == "https" {
		scheme = "https"
	}
	host := c.Request.Host
	if !util.IsLocalHost(host) {
		return "", errors.New("A loopback OIDC redirect URL is required for local access")
	}
	return scheme + "://" + host + "/api/system/oidc/callback", nil
}

func oidcValidationRedirectURL(c *gin.Context, config *conf.OIDC, mobile bool) (string, error) {
	if mobile {
		return oidcMobileRedirectURL, nil
	}
	if config.RedirectURL != "" {
		return validatePublicOIDCRedirectURL(config.RedirectURL)

View on GitHub (pinned to 251596fc0d)

Solutions

1. Access SiYuan from the same host via 127.0.0.1/localhost when using desktop OIDC login.
2. For non-local access, use the web OIDC flow which goes through validatePublicOIDCRedirectURL with a configured public redirect.
3. Configure the OIDC RedirectURL (public HTTPS) in settings so the web flow works remotely.

Example fix

# before — desktop login over LAN
open http://192.168.1.5:6806 -> click desktop OIDC -> error
# after — desktop login from the kernel host
open http://127.0.0.1:6806 -> click desktop OIDC -> ok
# or — use the web flow with a configured public redirect URL

if flow == oidcFlowDesktop && !model.IsLocalRequest(c) {
    return errors.New("desktop OIDC login must originate from localhost")
}

func desktopOK(c *gin.Context) bool { return model.IsLocalRequest(c) }

When it happens

Trigger: Initiating the desktop OIDC login flow from a browser pointed at a non-loopback SiYuan address (LAN IP or hostname), or via a reverse proxy that obscures the local origin.

Common situations: User accesses SiYuan over the LAN/VPN and clicks the desktop OIDC login button; the desktop flow's redirect URL would point at a loopback the user's browser cannot reach.

Related errors

• A loopback OIDC redirect URL is required for local access
• OIDC issuer URL must use HTTPS unless it is a loopback addre
• A public HTTPS OIDC redirect URL is required for remote acce
• OIDC redirect URL must end with /api/system/oidc/callback
• Public OIDC redirect URL must use HTTPS

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/910f209801dde44f. Report an issue: GitHub.