[GH-ISSUE #436] [Bug]: Using full URL vs localhost results in merged budget Files #7092

New Issue

2026-04-10T16:45:38-05:00

GiteaMirror commented

2026-04-10 16:45:38 -05:00

Originally created by @TechwizEE on GitHub (Jan 6, 2023).
Original GitHub issue: https://github.com/actualbudget/actual/issues/436

Verified issue does not already exist?

I have searched and found no existing issue

What happened?

The budget Files I create are getting merged together when I use the full URL to my Actual instance. I'm self-hosting the Actual Docker image in a VM on my local network.

I started testing Actual by forwarding port 5006 to my desktop. I browsed to http://localhost:5006 and created several budget Files in both Chrome and Firefox. Things worked smoothly. I was able to sync and see all File updates between Chrome and Firefox.

Seeing this worked well, I wiped/restarted the Actual instance, and used the full URL to the Actual instance. I started creating budget Files and found they were all getting merged together inconsistently. I stopped, wiped/restarted the Actual instance again, flushed the entire cache in both Chrome and Firefox, and found the issue persisted.

I also noticed Firefox showing Error: Fallback mode unable to write file changes in the dev console after I switched to the full URL.

As an aside, I've successfully hosted several other containers/services using this same full URL which gives me a level of confidence in my DNS setup.

I've done my best to document how to re-create this issue below.

Hosting Setup

Self-hosted Ubuntu VM running Docker engine on my local network, no reverse-proxy or other redirection
Used Docker Compose to spin up Actual version jlongster/actual-server:22.12.9
Here is the docker-compose.yaml file I'm using:

version: '3.3'
services:
  actual-server:
    image: jlongster/actual-server:22.12.9
    restart: always
    ports:
      - 5006:5006
    volumes:
      - data:/data

volumes:
  data:

Steps to Replicate Issue

Start with fresh Docker container

docker compose down -v   # Ensures named volume is wiped
docker compose pull
docker compose up -d

On Windows 10, using Chrome or Firefox, navigate to http://<full URL>:5006
Complete server setup, create budget Files with identifiable Account names and starting amounts
As you close each budget File, open the other ones, and see Accounts from other budget Files are showing up

Video 1

Server setup using Chrome, creation of budget Files, and how the budgets appear "merged."

https://user-images.githubusercontent.com/122043098/211085705-9e1a9516-c10e-454a-a2c6-3f7b72b203b6.mp4

Video 2

The "merged" budgets appear the same in Firefox. An additional budget File named My Finance 2 is created to see if the merged issue persists back to Chrome. Note: merging is not consistent across all three budget Files. Firefox shows warning of budget being open in another tab (see screenshot of associated details below).

https://user-images.githubusercontent.com/122043098/211085825-2411a5d3-4d8e-4192-9b50-bb819fa8a66e.mp4

Screenshot of error in Firefox debug console

Video 3

Shows the budget File My Finance 2 is seen in Chrome and the merged issue is still present. Opening My Finance 2 causes several uncaught errors (see screenshot below).

https://user-images.githubusercontent.com/122043098/211085853-831803b3-f9ed-46be-90de-feec7c76a6e8.mp4

Screenshot of uncaught error in Chrome debug console

What error did you receive?

Budget Files appear to be merged when created and opened using full URL to Actual instance. This issue was present for both Chrome and Firefox on Windows 10.

Additionally

Firefox showed several Error: Fallback mode unable to write file changes when accessing each budget for the first time using the full URL
Chrome showed several Uncaught (in promise) TypeError: Cannot read properties of null (reading 'prepare') upon opening My Finance 2

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Firefox, Chrome

Operating System

Windows 10

Originally created by @TechwizEE on GitHub (Jan 6, 2023). Original GitHub issue: https://github.com/actualbudget/actual/issues/436 ### Verified issue does not already exist? I have searched and found no existing issue ### What happened? The budget Files I create are getting merged together when I use the full URL to my Actual instance. I'm self-hosting the Actual Docker image in a VM on my local network. I started testing Actual by forwarding port `5006` to my desktop. I browsed to `http://localhost:5006` and created several budget Files in both Chrome and Firefox. Things worked smoothly. I was able to sync and see all File updates between Chrome and Firefox. Seeing this worked well, I wiped/restarted the Actual instance, and used the full URL to the Actual instance. I started creating budget Files and found they were all getting merged together inconsistently. I stopped, wiped/restarted the Actual instance again, flushed the entire cache in both Chrome and Firefox, and found the issue persisted. I also noticed Firefox showing `Error: Fallback mode unable to write file changes` in the dev console after I switched to the full URL. As an aside, I've successfully hosted several other containers/services using this same full URL which gives me a level of confidence in my DNS setup. I've done my best to document how to re-create this issue below. ### Hosting Setup - Self-hosted Ubuntu VM running Docker engine on my local network, no reverse-proxy or other redirection - Used Docker Compose to spin up Actual version `jlongster/actual-server:22.12.9` - Here is the `docker-compose.yaml` file I'm using: ```yaml version: '3.3' services: actual-server: image: jlongster/actual-server:22.12.9 restart: always ports: - 5006:5006 volumes: - data:/data volumes: data: ``` ### Steps to Replicate Issue - Start with fresh Docker container ```sh docker compose down -v # Ensures named volume is wiped docker compose pull docker compose up -d ``` - On Windows 10, using Chrome or Firefox, navigate to `http://<full URL>:5006` - Complete server setup, create budget Files with identifiable Account names and starting amounts - As you close each budget File, open the other ones, and see Accounts from other budget Files are showing up ### Video 1 Server setup using Chrome, creation of budget Files, and how the budgets appear "merged." https://user-images.githubusercontent.com/122043098/211085705-9e1a9516-c10e-454a-a2c6-3f7b72b203b6.mp4 ### Video 2 The "merged" budgets appear the same in Firefox. An additional budget File named `My Finance 2` is created to see if the merged issue persists back to Chrome. **Note: merging is not consistent across all three budget Files.** Firefox shows warning of budget being open in another tab (see screenshot of associated details below). https://user-images.githubusercontent.com/122043098/211085825-2411a5d3-4d8e-4192-9b50-bb819fa8a66e.mp4 ### Screenshot of error in Firefox debug console ![Screenshot 2023-01-06 143034](https://user-images.githubusercontent.com/122043098/211086863-50dbc45e-3d03-4cd9-8c76-d648aa7623fe.png) ### Video 3 Shows the budget File `My Finance 2` is seen in Chrome and the merged issue is still present. Opening `My Finance 2` causes several uncaught errors (see screenshot below). https://user-images.githubusercontent.com/122043098/211085853-831803b3-f9ed-46be-90de-feec7c76a6e8.mp4 ### Screenshot of uncaught error in Chrome debug console ![Screenshot 2023-01-06 140341](https://user-images.githubusercontent.com/122043098/211086066-73ef62e4-d97f-43a1-92c7-bebf849852a5.png) ### What error did you receive? Budget Files appear to be merged when created and opened using full URL to Actual instance. This issue was present for both Chrome and Firefox on Windows 10. ### Additionally - Firefox showed several `Error: Fallback mode unable to write file changes` when accessing each budget for the *first time* using the full URL - Chrome showed several `Uncaught (in promise) TypeError: Cannot read properties of null (reading 'prepare')` upon opening `My Finance 2` ### Where are you hosting Actual? Docker ### What browsers are you seeing the problem on? Firefox, Chrome ### Operating System Windows 10

GiteaMirror added the bug label 2026-04-10 16:45:38 -05:00

GiteaMirror closed this issue

2026-04-10 16:45:39 -05:00

GiteaMirror commented

2026-04-10 16:45:40 -05:00

@TechwizEE commented on GitHub (Jan 8, 2023):

I've played with this a bit more.

It appears accessing Actual with http (without the s) causes the browser to ignore the Cross-Origin-Opener-Policy (see screenshot below from Chrome on Windows 10).

Digging around I found documentation on absurd-sql (the database used by Actual) indicating specific headers are required for a browser to allow SharedArrayBuffer. Here's a comment that seemed most relevant: https://github.com/jlongster/absurd-sql/issues/14#issuecomment-902116794

I setup a quick NGINX reverse-proxy with certs and changed my Docker Compose script to place it in front of my Actual instance. I browsed to Actual using https and the merged-budgets issue when away. I re-tested my setup with NGINX reverse-proxy three times using the steps I outlined up above and had the same (good!) outcome: each of the budgets were separate (expected functionality) and synced without issue between Firefox and Chrome.

The issue appears to be with the choice of using http to access Actual.

Switching to https resolved the issue.

For reference, here is the .conf file I used for the NGINX reverse-proxy (replace <full_URL> with the URL to your Actual instance):

#ssl on;  # deprecated, use ssl parameter on the listen directive
ssl_session_cache  builtin:1000  shared:SSL:10m;
ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;

proxy_read_timeout 90;

# Redirect from HTTP to HTTPS
server {
    listen 80;          # Listen for all traffic on port 80
    server_name _;      # Matches any hostname
    return 301 https://$host$request_uri;   # 301 tells browser this is a permanent redirect and specifies the HTTPS version of the original request on port 80
}

server {
    listen 443 ssl;
    server_name <full_URL>;

    ssl_certificate         /etc/nginx/certs/<full_URL>.cert-chain.pem;
    ssl_certificate_key     /etc/nginx/certs/<full_URL>.com.key.pem;

    location / {
        proxy_pass http://actualserver:5006/;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

@TechwizEE commented on GitHub (Jan 8, 2023): I've played with this a bit more. It appears accessing Actual with `http` (without the `s`) causes the browser to ignore the `Cross-Origin-Opener-Policy` (see screenshot below from Chrome on Windows 10). ![Screenshot 2023-01-08 144507](https://user-images.githubusercontent.com/122043098/211217102-a939e942-6043-4eab-a8c0-6f26f828d330.png) Digging around I found documentation on `absurd-sql` (the database used by Actual) indicating specific headers are required for a browser to allow `SharedArrayBuffer`. Here's a comment that seemed most relevant: https://github.com/jlongster/absurd-sql/issues/14#issuecomment-902116794 I setup a quick NGINX reverse-proxy with certs and changed my Docker Compose script to place it in front of my Actual instance. I browsed to Actual using `https` and the merged-budgets issue when away. I re-tested my setup with NGINX reverse-proxy three times using the steps I outlined up above and had the same (good!) outcome: each of the budgets were separate (expected functionality) and synced without issue between Firefox and Chrome. The issue appears to be with the choice of using `http` to access Actual. **Switching to `https` resolved the issue.** For reference, here is the `.conf` file I used for the NGINX reverse-proxy (replace `<full_URL>` with the URL to your Actual instance): ``` #ssl on; # deprecated, use ssl parameter on the listen directive ssl_session_cache builtin:1000 shared:SSL:10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4; ssl_prefer_server_ciphers on; proxy_read_timeout 90; # Redirect from HTTP to HTTPS server { listen 80; # Listen for all traffic on port 80 server_name _; # Matches any hostname return 301 https://$host$request_uri; # 301 tells browser this is a permanent redirect and specifies the HTTPS version of the original request on port 80 } server { listen 443 ssl; server_name <full_URL>; ssl_certificate /etc/nginx/certs/<full_URL>.cert-chain.pem; ssl_certificate_key /etc/nginx/certs/<full_URL>.com.key.pem; location / { proxy_pass http://actualserver:5006/; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ```

GiteaMirror commented

2026-04-10 16:45:41 -05:00

@TechwizEE commented on GitHub (Jan 12, 2023):

Mentioning https://github.com/actualbudget/actual-server/issues/15 as this describes the exact same issue. actual-server may have been a better place for me to have put this issue (#436)

@TechwizEE commented on GitHub (Jan 12, 2023): Mentioning https://github.com/actualbudget/actual-server/issues/15 as this describes the exact same issue. `actual-server` may have been a better place for me to have put this issue (#436)