starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Add support for web client check mode #585

New Issue
Closed
opened 2025-12-29 02:20:49 +01:00 by adam · 6 comments
adam commented 2025-12-29 02:20:49 +01:00
Owner
Copy Link

Originally created by @willnorris on GitHub (Nov 28, 2023).

Originally assigned to: @juanfont on GitHub.

The Tailscale web client (the one you get by running tailscale web), is currently getting a complete overhaul, bringing it more-or-less on par with the native clients. Because it exposes much more functionality than the old client, we are adding an additional auth flow which is effectively identical to SSH check mode, but tied to specific browser sessions. In order to make changes via a device's web client, the user has to have an active session that has authenticated with the control server.

For launch, we are only going to enforce check mode when using a "tailscale.com" control server, and just not require it otherwise. I'm opening this as a tracking bug for adding support in headscale so that we can use check mode with headscale as well. (Maybe we should allow the control server to advertise support, so then we only require it with newer headscale versions? We'll see)

Web client source: https://github.com/tailscale/tailscale/tree/main/client/web
Machine API calls to control server can be seen in doWebClientNoiseRequest of https://github.com/tailscale/tailscale/blob/main/ipn/ipnlocal/web_client.go

Originally created by @willnorris on GitHub (Nov 28, 2023). Originally assigned to: @juanfont on GitHub. The Tailscale web client (the one you get by running `tailscale web`), is currently getting a complete overhaul, bringing it more-or-less on par with the native clients. Because it exposes much more functionality than the old client, we are adding an additional auth flow which is effectively identical to SSH check mode, but tied to specific browser sessions. In order to make changes via a device's web client, the user has to have an active session that has authenticated with the control server. For launch, we are only going to enforce check mode when using a "tailscale.com" control server, and just not require it otherwise. I'm opening this as a tracking bug for adding support in headscale so that we can use check mode with headscale as well. (Maybe we should allow the control server to advertise support, so then we only require it with newer headscale versions? We'll see) Web client source: https://github.com/tailscale/tailscale/tree/main/client/web Machine API calls to control server can be seen in `doWebClientNoiseRequest` of https://github.com/tailscale/tailscale/blob/main/ipn/ipnlocal/web_client.go
adam added the enhancementstale labels 2025-12-29 02:20:49 +01:00
adam closed this issue 2025-12-29 02:20:50 +01:00
adam commented 2025-12-29 02:20:50 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Feb 27, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Feb 27, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:20:50 +01:00
Author
Owner
Copy Link

@juanfont commented on GitHub (Mar 6, 2024):

@willnorris hey Will, I am looking into this. Thanks for opening the issue!

Maybe we should allow the control server to advertise support

For the clients, we are pretty familiar with CapVer. But I am not aware -and cannot find it anywhere- an equivalent facility for the Control Server to announce its capabilities (e.g., supports tailnet lock, or this one on the check mode...). Am I missing something?

@juanfont commented on GitHub (Mar 6, 2024): @willnorris hey Will, I am looking into this. Thanks for opening the issue! > Maybe we should allow the control server to advertise support For the clients, we are pretty familiar with CapVer. But I am not aware -and cannot find it anywhere- an equivalent facility for the Control Server to announce its capabilities (e.g., supports tailnet lock, or this one on the check mode...). Am I missing something?
adam commented 2025-12-29 02:20:50 +01:00
Author
Owner
Copy Link

@willnorris commented on GitHub (Mar 6, 2024):

No, that was just an idea we had. We never ended up implementing it.

@willnorris commented on GitHub (Mar 6, 2024): No, that was just an idea we had. We never ended up implementing it.
adam commented 2025-12-29 02:20:50 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jun 5, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Jun 5, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:20:51 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Sep 4, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Sep 4, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:20:51 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Sep 11, 2024):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (Sep 11, 2024): This issue was closed because it has been inactive for 14 days since being marked as stale.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#585
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?