Dashboard fetch fails with "Request cannot be constructed from a URL that includes credentials" when accessing via Basic Auth in URL

[richex-cn]

Bug Description

When accessing the frp dashboard using a URL that includes HTTP Basic Auth credentials directly (e.g. https://user:password@yourdomain.com:7500/), the dashboard frontend fails to load server info.
A browser console error appears:

Failed to execute 'fetch' on 'Window': Request cannot be constructed from a URL that includes credentials: ../api/serverinfo

After this error, a popup shows: "Get server info from frps failed!"

If I remove the user:password@ part from the URL and let the browser prompt for credentials, everything works normally.

Expected behavior

The dashboard should load normally even when credentials are provided in the URL (many users bookmark such URLs for quick access without repeated login prompts).

Environment

• Browser: Chrome 145

Additional context

This is a browser security restriction: modern browsers forbid constructing fetch() requests from a URL that contains embedded credentials (username:password@) for security reasons (URL leaking, logging, etc.).

Thanks for this great tool!

frpc Version

0.67.0

frps Version

0.67.0

System Architecture

windows/amd64

Configurations

# frps.toml
bindPort = 7000

auth.token = "123456"

webServer.addr = "0.0.0.0"
webServer.port = 7500
webServer.user = "admin"
webServer.password = "123456"
webServer.pprofEnable = false

Logs

No response

Steps to reproduce

1. Configure frps with dashboard enabled and HTTP Basic Auth
2. Access the dashboard using a convenience URL with credentials embedded:
   https://admin:yourpass@dashboard.example.com:7500/
3. Dashboard shows error popup.

Affected area

• Docs
• Installation
• Performance and Scalability
• Security
• User Experience
• Test and Release
• Developer Infrastructure
• Client Plugin
• Server Plugin
• Extensions
• Others

[github-actions]

Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.