Issue Station
Sign In
Tools hereToolbox

hermes - ✅(Solved) Fix Dashboard: /api/skills returns 401 Unauthorized on v0.11+ (header case mismatch) [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
NousResearch/hermes-agent#16726•Fetched 2026-04-28 06:51:12
View on GitHub
Comments
1
Participants
2
Timeline
7
Reactions
0
Author
gkreisgkreis
Participants
gkreisgkreisluyao618luyao618
Timeline (top)
labeled ×4commented ×1cross-referenced ×1referenced ×1

Root Cause

After upgrading to Hermes Agent v0.11, the Skills page in the web dashboard shows "No skills found" even though many skills are installed at ~/.hermes/skills/. The root cause is a header case-sensitivity bug in web_server.py.

Fix Action

Fixed

PR fix notes

PR #16758: fix(dashboard): normalize session header lookup to lowercase

Description (problem / solution / changelog)

What does this PR do?

Fixes the dashboard session header lookup that silently fails due to HTTP header case normalization. Starlette (FastAPI's ASGI layer) lowercases all incoming header names, but the lookup used the mixed-case constant X-Hermes-Session-Token. The .get() call always returned an empty string, causing every /api/ endpoint to return 401 Unauthorized — including /api/skills.

The fix normalizes the lookup key to lowercase so it matches the framework's internal representation.

Related Issue

Fixes #16726

Type of Change

  • 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

  • hermes_cli/web_server.py: Changed request.headers.get(_SESSION_HEADER_NAME, "") to request.headers.get(_SESSION_HEADER_NAME.lower(), "") on line 120
  • tests/hermes_cli/test_web_server.py: Added test_session_header_case_insensitive test that verifies authentication works with mixed-case, lowercase, and uppercase header names

How to Test

  1. Start the dashboard: hermes dashboard --port 9119
  2. Open the Skills page in the web UI — it should now load skills instead of showing "No skills found"
  3. Run the targeted test: pytest tests/hermes_cli/test_web_server.py::TestWebServerEndpoints::test_session_header_case_insensitive -v
  4. Run full suite: pytest tests/ -q --ignore=tests/integration --ignore=tests/e2e

Checklist

Code

  • I've read the Contributing Guide
  • My commit messages follow Conventional Commits
  • I searched for existing PRs to make sure this isn't a duplicate
  • My PR contains only changes related to this fix
  • I've run pytest tests/ -q and all tests pass
  • I've added tests for my changes
  • I've tested on my platform: macOS (Darwin 25.4.0, Apple Silicon), Python 3.11

Documentation & Housekeeping

  • Updated relevant documentation — or N/A
  • Updated cli-config.yaml.example — or N/A
  • Updated contributing / agents docs — or N/A
  • Considered cross-platform impact — or N/A
  • Updated tool descriptions/schemas — or N/A

Changed files

  • hermes_cli/web_server.py (modified, +1/-1)
  • tests/hermes_cli/test_web_server.py (modified, +17/-0)
RAW_BUFFERClick to expand / collapse

After upgrading to Hermes Agent v0.11, the Skills page in the web dashboard shows "No skills found" even though many skills are installed at ~/.hermes/skills/. The root cause is a header case-sensitivity bug in web_server.py.

Root Cause

Starlette (FastAPI's ASGI framework) normalizes all HTTP headers to lowercase. When the browser sends X-Hermes-Session-Token, it arrives as x-hermes-session-token in request.headers.

In hermes_cli/web_server.py line 120, the code looks up:
python
session_header = request.headers.get(_SESSION_HEADER_NAME, "")

where _SESSION_HEADER_NAME = "X-Hermes-Session-Token" (mixed case). This returns an empty string because the actual key is lowercase. The auth middleware then rejects every /api/ endpoint with 401 Unauthorized — including /api/skills.

The Authorization: Bearer fallback on line 127 works because it's already lowercase, but that path isn't used by the SPA.

Fix

Change line 120 from:
python
session_header = request.headers.get(_SESSION_HEADER_NAME, "")

to:
python
session_header = request.headers.get(_SESSION_HEADER_NAME.lower(), "")


Reproduction Steps

1. Install Hermes Agent v0.11+
2. Run hermes dashboard --port 9119
3. Open the web UI and navigate to the Skills page
4. Observe "No skills found" despite having many SKILL.md files in ~/.hermes/skills/

Environment

- Hermes Agent: v0.11.0
- OS: Linux Mint (but affects all platforms — this is a framework-level issue)
- Browser: any (the bug is on the server-side header lookup, not client-specific)

extent analysis

TL;DR

Change the header lookup in hermes_cli/web_server.py to use lowercase to fix the case-sensitivity bug.

Guidance

  • Verify that the issue is resolved by checking the Skills page in the web dashboard after applying the fix.
  • The bug is caused by the mismatch between the expected header case in hermes_cli/web_server.py and the actual lowercase header received from the browser.
  • To mitigate the issue, update the code to use the lowercase version of the header name, as shown in the proposed fix.
  • Ensure that the Hermes Agent version is v0.11.0 or later, as the issue is specific to this version.

Example

session_header = request.headers.get(_SESSION_HEADER_NAME.lower(), "")

Notes

This fix should apply to all platforms, as it is a framework-level issue. The bug is not client-specific, so it should not matter which browser is used.

Recommendation

Apply the workaround by changing the header lookup to use lowercase, as this directly addresses the identified root cause of the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#output truncation#response parsing#generation error#database connection

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - ✅(Solved) Fix Dashboard: /api/skills returns 401 Unauthorized on v0.11+ (header case mismatch) [1 pull requests, 1 comments, 2 participants]