Desktop browser blocks Local Network Access, so Okta Verify sign-in fails

Summary

Okta sign-in fails in the bb browser. Okta Verify talks to a local app through localhost. Chromium needs the "Local network access" permission for that. The bb browser session denies every permission except clipboard-sanitized-write, so the request fails at once. The user has no site settings where they can allow it.

Versions and environment

bb 0.45.0 (desktop app), Electron 44.3.0
macOS 26.6.2
Okta Verify desktop app installed

Steps to reproduce

Open a bb browser tab.
Go to an Okta-protected sign-in page that uses Okta Verify (FastPass).
Choose to sign in with Okta Verify.

Expected vs actual

Unable to sign in
The browser is blocking communication with Okta Verify.
Go to your browser's site settings
Find "Local network access" or "Apps on device"
Change the permission from "Block" to "Allow" and reload this page

Expected: Okta Verify opens and sign-in completes, as it does in Chrome.

Evidence

Allowlist on main:

bb/apps/desktop/src/desktop-browser-view.ts

Lines 420 to 422 in 53c1e87

    
           function isAllowedBrowserPermission(permission: string): boolean { 
        
             return permission === "clipboard-sanitized-write"; 
        
           }

It is used for both handlers:

bb/apps/desktop/src/desktop-browser-view.ts

Lines 544 to 549 in 53c1e87

    
           browserSession.setPermissionRequestHandler((_wc, permission, callback) => { 
        
             callback(isAllowedBrowserPermission(permission)); 
        
           }); 
        
           browserSession.setPermissionCheckHandler((_wc, permission) => 
        
             isAllowedBrowserPermission(permission), 
        
           );

What you ruled out

Plugins can't fix this: the SDK can't change the session permission handlers.
Not Provide a user-approved local file upload path for browser automation #3357 or Codex Browser Use approvals are auto-declined in accept-edits mode (no interaction shown) #4645: those are about file upload and Codex approvals.

Possible fix

Allow local-network-access (and the related loopback permission), or prompt the user for each origin. An allowlist (for example *.okta.com) would also work.

Workaround

Sign in with Chrome, quit Chrome, then copy the cookies with bb browser import-cookies. You must do this again when the session expires.

AGENT GENERATED

🚨 SLOP COP 🚨 · new-issue-autopilot

Classification: Bug · Priority: Medium · Effort: Medium · labels: desktop, security, partial-repro.
Report: https://get-bb.github.io/reports/issues/5191.html
Verdict: PARTIALLY REPRODUCED · root-cause confidence: high for the permission denial. The macOS/Okta Verify sign-in flow was not available to test.
Root cause: Both desktop browser session handlers grant only sanitized clipboard writes, denying local-network and loopback permissions without an origin consent path.
Reproduction: Three focused cases fail identically in two clean checkouts of trusted origin/main; the unchanged manager suite passes all 77 tests. Reproduction label: partial-repro.
No PR: A repair changes a permission/security boundary and requires a policy decision, so it is outside the automatic simple-fix rules.

The fix is small: add local-network-access, local-network, and loopback-network to the permission allowlist in isAllowedBrowserPermission (apps/desktop/src/desktop-browser-view.ts), which backs both session permission handlers. The change itself is a few lines.

Reference: benwaffle@72199b7. It is a commit on a fork branch that gets rebased daily, so the link may move.

Navigation Menu

Repository navigation

Desktop browser blocks Local Network Access, so Okta Verify sign-in fails #5191

Summary

Versions and environment

Steps to reproduce

Expected vs actual

Evidence

What you ruled out

Possible fix

Workaround

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	function isAllowedBrowserPermission(permission: string): boolean {
	return permission === "clipboard-sanitized-write";
	}

	browserSession.setPermissionRequestHandler((_wc, permission, callback) => {
	callback(isAllowedBrowserPermission(permission));
	});
	browserSession.setPermissionCheckHandler((_wc, permission) =>
	isAllowedBrowserPermission(permission),
	);

Desktop browser blocks Local Network Access, so Okta Verify sign-in fails #5191

Description

Summary

Versions and environment

Steps to reproduce

Expected vs actual

Evidence

What you ruled out

Possible fix

Workaround

Activity

bb-slop-cop commented on Oct 8, 2026

benwaffle commented on Oct 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions