I am using cockpit on my machines to manage and visualize some stuff, but I have noticed that at least after the latest updates there is some weirdness going on with it.
When I try to access it at http://localhost:9090 I get the login screen and when I enter my credentials, it immediately bumps me back to the login screen instead going to the application.
If I then change the url to https://localhost:9090 it does log in.
However, I immediately go to the https url, same thing: it bumps me back to the login screen again. If I then connect to http instead, it does log in.
This does not make any sense. 
I have verified this at both my laptop and my desktop; same behavior. And with multiple browsers, both firefox based as well as chromium based.
Any suggestions as to how to fix? Or is this a bug and I have to wait for an update from OpenSUSE?
Out of curiousity I tried to reproduce that behaviour.
I can just reproduce it by clicking your links to http(s)://localhost:9090
Usually I start cockpit by using a desktop (menu) starter that runs firefox localhost:9090, just typing localhost:9090 in firefox’s address bar or using my bookmark.
I never noticed that behaviour.
The only way I can reproduce it is clicking your links here.
It’s indeed a bit interesting. I tested now typing the exact link in the address bar (including http:// or https://, which should be the same as clicking your links) and did not get that behaviour. I tried again my bookmark, starter, just typing localhost:9090. I can not reproduce it except when I click your links.
So, my guess is black magic or cursed links 
I have no clue why it is like that, but it is interesting.
Tested with cockpit version 338-1.1 and firefox version 139.0.4-1.1
What browser opens when you click on http(s) links?
It opens in firefox, which is already open because I use it to read this post.
No difference whether I open it in the active tab or a new tab.
Edit: Just tried it in Chromium and I can’t reproduce it there.
Indeed weird. I use links (my homepage is set to an instance of https://gethomepage.dev/), but when I ALT-D and enter, ie just going to the addressbar and enter as if I typed a URL but without actually typing or changing anything it will take my password and log in.