luci-app-attendedsysupgrade: searching for upgrade hangs when using my own asu server

[MaxRower]

Is there an existing issue for this?

• I have searched among all existing issues (including closed issues)

screenshots or captures

Actual behaviour

When I try to use my own asu server, it hangs after clicking "Search for firmware upgrade".
When I use "owut upgrade" on the same device, everything runs fine, and the device restarts with the upgraded release.

When I look at the logs of the asu_server container, the last entry alway is:

INFO:     10.89.0.9:59742 - "GET /api/v1/overview?1774787541239 HTTP/1.1" 301 Moved Permanently

which does a redirect to /json/v1/overview.json. Apperently, the local browser(?) does not follow the redirect?
I tried firefox and chromium with Ubuntu 24.04.

I tried setting privacy.file_unique_origin=false in Firefox, but it did not help.

System info of the device is after the upgrade, but it won't work here as well.

Expected behaviour

n/a

Steps to reproduce

n/a

Additional Information

{
	"kernel": "6.12.74",
	"hostname": "archer-c7",
	"system": "Qualcomm Atheros QCA9558 ver 1 rev 0",
	"model": "TP-Link Archer C7 v2",
	"board_name": "tplink,archer-c7-v2",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "25.12.2",
		"firmware_url": "https://downloads.openwrt.org/",
		"revision": "r32802-f505120278",
		"target": "ath79/generic",
		"description": "OpenWrt 25.12.2 r32802-f505120278",
		"builddate": "1774469393"
	}
}

What browsers do you see the problem on?

Firefox

Relevant log output

[efahl]

Sounds like your server isn't handling CORS properly. What proxy server are you using?

If you're using caddy, this should work, as long as you import the caddy certs into your browser.

$ cat /etc/caddy/Caddyfile
(cors) {
        @cors_preflight method OPTIONS
        @cors header Origin {args.0}

        handle @cors_preflight {
                header Access-Control-Allow-Origin "{args.0}"
                header Access-Control-Allow-Headers "Content-Type"
                respond "" 204
        }

        handle @cors {
                header Access-Control-Allow-Origin "{args.0}"
        }
}

sysupgrade.my.lan sysupgrade.my.lan:80 sysupgrade.my.lan:443 {
        import cors *
        reverse_proxy http://localhost:8000
        tls internal
}

[MaxRower]

No proxy used. Just the docker container for asu, connection via internal LAN.

[efahl]

You'll never get a modern browser to work with that, as CORS headers are a server side thing. But, you could use owut as it doesn't care about any of these new fangled security features and will happily talk to a local http: host on a non-80 port...

$ uci set attendedsysupgrade.server.url="http://10.1.1.207:8000"

$ owut upgrade -v
owut - OpenWrt Upgrade Tool 2026.01.13~2526d84b-r1 (/usr/bin/owut)
ASU-Server     http://10.1.1.207:8000
Upstream       https://downloads.openwrt.org
Target         x86/64
Profile        generic
...

[MaxRower]

CORS headers are a server side thing

Did I miss any docs, that asu NEEDS a reverse proxy to function with attended sysupgrade?
As I wrote in my post, owut did work, but after upgrading other routers, it often hanged and produced errors.

Sun Mar 29 16:08:41 2026 kern.warn kernel: [  293.323936] owut invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
Sun Mar 29 16:08:41 2026 kern.warn kernel: [  293.335334] CPU: 0 UID: 0 PID: 3819 Comm: owut Tainted: G           O       6.12.74 #0
Sun Mar 29 16:08:41 2026 kern.warn kernel: [  293.343396] Tainted: [O]=OOT_MODULE
Sun Mar 29 16:08:41 2026 kern.warn kernel: [  293.346936] Hardware name: TP-Link Archer C7 v2

[hamlibdk]

I am noticing something similar at my end (2026-03-30 around UTC: 4:00); The message reported by MaxRower is just remaining on the web-intercase indefinitely and is not registering any fail/timeout.

Note that the image CAN be downloaded offline.

Yet it is not progressing to deployment. There may be possibility that this is related to this report.

[Alezzzander]

I have similar error when trying to upgrade from 25.12.1 to 25.12.2 using Luci Attended Sysupgrade but with Default ASU server.
Have this error in firefox:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://asu.openwrt.ansuel.com/store/....bin. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.