Workspace file preview returns 401 Unauthorized on non-HTTPS non-loopback hosts

Operating System

Linux

Installation Method

npm (npx @openhands/agent-canvas or npm install -g @openhands/agent-canvas)

Agent Canvas Version

1.0.0

Bug Description

When running agent-canvas on a non-HTTPS hostname, workspace file preview can fail with 401 Unauthorized even though the rest of the UI works. Example usecases this will happen:

• Running agent-canvas in a VM that has its own IP address on a laptop and accessing host.
• Running agent-canvas in a container and accessing containers IP address from laptop.
• Running backend on a more powerful headless server in your house or work lab and accessing from laptop browser.

This affects URLs like: http://:8000/api/conversations/<conversation_id>/workspace/index.html

The root problem appears to be that POST /api/auth/workspace-session may mint oh_workspace_session_key with Secure even when the browser is actually using plain HTTP on a non-loopback hostname. The browser then does not send that cookie on the follow-up workspace file request, so /api/conversations/:id/workspace/* returns 401.

Although this could be worked around by installing a reverse proxy with a self signed cert so that https:// can be used, this is overkill for home environment or for initial investigation of agent-canvas. Having an --disable-secure option to work with http in would help here.

Steps to Reproduce

1. Setup agent-canvas in --public mode so easier to control api-key.
2. Access from remote browser using api-key
3. Have agent create a local file and use file bowser to view it.

Actual Behavior

401 error reported

Expected Behavior

Able to access it.

Relevant Logs

Screenshots

No response

Additional Context

No response