fix: handle 403/404 on internal auth status endpoint gracefully #4110
Conversation
Fixes Skyvern-AI#3782 When running self-hosted Skyvern remotely, the UI incorrectly displays 'Unable to verify Skyvern API key' error because the backend restricts /api/v1/internal/auth/status to localhost access only. This change adds an Axios response interceptor that catches 403/404 responses from the internal auth status endpoint and treats them as successful, preventing misleading error messages while maintaining proper functionality for all other API endpoints. The fix: - Adds interceptor to all axios clients (v1, v2, and sans-api-v1) - Only intercepts /internal/auth/status endpoint - Logs warning for debugging purposes - Returns synthetic 200 response for this specific case - Does not affect backend security or other API endpoints
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughAdds explanatory comments about an interceptor for 403/404 responses from the internal auth status endpoint and applies that interceptor setup across three Axios instances using a forEach; no exported signatures or response-synthesis logic were changed. Changes
Sequence Diagram(s)sequenceDiagram
participant Setup as Startup
participant ClientA as client
participant ClientB as v2Client
participant ClientC as clientSansApiV1
Note over Setup: Register interceptor across instances
Setup->>ClientA: register interceptor (commented)
Setup->>ClientB: register interceptor (commented)
Setup->>ClientC: register interceptor (commented)
Note right of ClientA: Interceptor presence documented only
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (5 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![ellipsis-dev[bot]](https://avatars.githubusercontent.com/in/64358?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
Looks good to me! 👍
Reviewed everything up to 3b39273 in 53 seconds. Click for details.
- Reviewed
47lines of code in1files - Skipped
0files when reviewing. - Skipped posting
3draft comments. View those below. - Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.
1. skyvern-frontend/src/api/AxiosClient.ts:136
- Draft comment:
Consider using a stricter match (e.g. regex or exact comparison) for the internal auth endpoint to avoid unintended interception of similarly named URLs. - Reason this comment was not posted:
Confidence changes required:33%<= threshold50%None
2. skyvern-frontend/src/api/AxiosClient.ts:146
- Draft comment:
Consider including a 'statusText' (e.g. 'OK') in the synthetic response for better consistency with standard 200 responses. - Reason this comment was not posted:
Confidence changes required:33%<= threshold50%None
3. skyvern-frontend/src/api/AxiosClient.ts:131
- Draft comment:
Optional: Ensure that error.response is defined before spreading it. The current logic works for expected 403/404 cases, but a guard could improve robustness. - Reason this comment was not posted:
Confidence changes required:33%<= threshold50%None
Workflow ID: wflow_Y4p8unMXN5r1lPgE
You can customize 
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
skyvern-frontend/src/api/AxiosClient.ts (1)
126-158: Implementation correctly solves the UX issue.The interceptor successfully converts 403/404 responses from the internal auth status endpoint into synthetic 200 responses, preventing misleading API key error banners. The logic is sound and the error handling is appropriate.
However, consider refining the URL matching for better precision:
The condition on lines 136-138 has a redundant check. Any URL ending with
/api/v1/internal/auth/statuswill already matchincludes("/internal/auth/status"), making the second condition unnecessary. Additionally,includes()is quite broad and would match URLs like/foo/internal/auth/status/bar.Apply this diff for more precise matching:
- const isInternalAuth = - url.includes("/internal/auth/status") || - url.endsWith("/api/v1/internal/auth/status"); + const isInternalAuth = url.endsWith("/internal/auth/status");This ensures the check matches only URLs that actually end with the auth status endpoint path, reducing the chance of false positives while removing the redundant condition.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
skyvern-frontend/src/api/AxiosClient.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
skyvern-frontend/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
skyvern-frontend/**/*.{ts,tsx,js,jsx}: Usenpm run lintandnpm run formatfor linting and formatting frontend code in skyvern-frontend/
Maintain line length of 120 characters for TypeScript/JavaScript code
Files:
skyvern-frontend/src/api/AxiosClient.ts
**/*.{py,ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Use async/await patterns for asynchronous operations
Files:
skyvern-frontend/src/api/AxiosClient.ts
🔇 Additional comments (1)
skyvern-frontend/src/api/AxiosClient.ts (1)
122-125: Clear documentation of the workaround.The comments effectively explain the problem, the solution, and link to the issue for context.
There was a problem hiding this comment.
Pull request overview
This PR fixes a user experience issue where self-hosted Skyvern instances accessed remotely display a misleading "Unable to verify Skyvern API key" error banner. The backend intentionally restricts the /api/v1/internal/auth/status endpoint to localhost-only access (returning 403), but the frontend was misinterpreting this as an authentication failure.
Key Changes:
- Added an Axios response interceptor that gracefully handles 403/404 responses specifically from the
/internal/auth/statusendpoint by converting them to synthetic 200 OK responses - Preserves existing functionality and security posture while improving UX for Docker/remote deployments
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ); | ||
| return Promise.resolve({ | ||
| ...error.response, | ||
| status: 200, |
There was a problem hiding this comment.
The synthetic response object may be incomplete. The interceptor spreads error.response but then overrides status and data. However, Axios response objects have additional properties like statusText, headers, and config that may not align with the synthetic 200 status.
Consider creating a more complete response object:
return Promise.resolve({
...error.response,
status: 200,
statusText: 'OK',
data: { status: "ok" },
});This ensures the response is more consistent with a genuine 200 response.
| status: 200, | |
| status: 200, | |
| statusText: 'OK', |
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
1 participant
Description
Fixes misleading "Unable to verify Skyvern API key" error when running self-hosted Skyvern instances accessed remotely.
Problem
When running Skyvern via Docker Compose and accessing it from a non-localhost address, the UI displays an error banner saying "Unable to verify Skyvern API key" even though the API key is correctly configured and all other API requests succeed.
Root cause: The backend intentionally restricts
/api/v1/internal/auth/statusto localhost-only access, returning 403 Forbidden. The frontend misinterprets this 403 as an API key failure.Solution
Added an Axios response interceptor that gracefully handles 403/404 responses specifically from the
/internal/auth/statusendpoint by:Impact
Testing
Tested on self-hosted installation with:
Fixes #3782
🛠️ This PR fixes misleading "Unable to verify Skyvern API key" errors that appear when accessing self-hosted Skyvern instances remotely. It adds an Axios response interceptor that gracefully handles 403/404 responses from the internal auth status endpoint, which is intentionally restricted to localhost-only access by the backend.
🔍 Detailed Analysis
Key Changes
AxiosClient.tsthat catches 403/404 responses specifically from/internal/auth/statusendpointTechnical Implementation
sequenceDiagram participant UI as Frontend UI participant Axios as Axios Interceptor participant API as Backend API UI->>+Axios: GET /internal/auth/status Axios->>+API: Forward request API-->>-Axios: 403 Forbidden (localhost only) Note over Axios: Interceptor detects internal auth endpoint Note over Axios: Status is 403/404 Axios->>Axios: Convert to synthetic 200 OK Axios->>Axios: Log warning message Axios-->>-UI: Return { status: 200, data: { status: "ok" } } Note over UI: No error banner displayedImpact
Created with Palmier
Important
Adds Axios interceptor in
AxiosClient.tsto handle 403/404 from/internal/auth/status, converting them to 200 OK to prevent misleading error messages.AxiosClient.tsto handle 403/404 from/internal/auth/statusendpoint.{ status: "ok" }data.This description was created by
for 3b39273. You can customize this summary. It will automatically update as commits are pushed.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.