Skip to content

Commit b9a0e2e

Browse files
kylecarbskylecarbs
committed
chore: remove BypassRatelimits option in codersdk.Client
It feels wrong to have this as a direct option because it's so infrequently needed by API callers. It's better to directly modify headers in the two places that we actually use it.
1 parent fe02a9f commit b9a0e2e

37 files changed

+149
-166
lines changed

‎cli/scaletest.go

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"encoding/json"
66
"fmt"
77
"io"
8+
"net/http"
89
"os"
910
"strconv"
1011
"strings"
@@ -328,7 +329,14 @@ func scaletestCleanup() *cobra.Command {
328329
return err
329330
}
330331

331-
client.BypassRatelimits = true
332+
client.HTTPClient = &http.Client{
333+
Transport: &headerTransport{
334+
transport: http.DefaultTransport,
335+
headers: map[string]string{
336+
codersdk.BypassRatelimitHeader: "true",
337+
},
338+
},
339+
}
332340

333341
cmd.PrintErrln("Fetching scaletest workspaces...")
334342
var (
@@ -506,7 +514,14 @@ It is recommended that all rate limits are disabled on the server before running
506514
return err
507515
}
508516

509-
client.BypassRatelimits = true
517+
client.HTTPClient = &http.Client{
518+
Transport: &headerTransport{
519+
transport: http.DefaultTransport,
520+
headers: map[string]string{
521+
codersdk.BypassRatelimitHeader: "true",
522+
},
523+
},
524+
}
510525

511526
if count <= 0 {
512527
return xerrors.Errorf("--count is required and must be greater than 0")

‎cli/tokens.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ func createToken() *cobra.Command {
7373
cmd.Println(cliui.Styles.Code.Render(strings.TrimSpace(res.Key)))
7474
cmd.Println()
7575
cmd.Println(cliui.Styles.Wrap.Render(
76-
fmt.Sprintf("You can use this token by setting the --%s CLI flag, the %s environment variable, or the %q HTTP header.", varToken, envSessionToken, codersdk.SessionCustomHeader),
76+
fmt.Sprintf("You can use this token by setting the --%s CLI flag, the %s environment variable, or the %q HTTP header.", varToken, envSessionToken, codersdk.SessionTokenHeader),
7777
))
7878

7979
return nil

‎coderd/apikey.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -343,7 +343,7 @@ func (api *API) createAPIKey(ctx context.Context, params createAPIKeyParams) (*h
343343
// This format is consumed by the APIKey middleware.
344344
sessionToken := fmt.Sprintf("%s-%s", keyID, keySecret)
345345
return &http.Cookie{
346-
Name: codersdk.SessionTokenKey,
346+
Name: codersdk.SessionTokenCookie,
347347
Value: sessionToken,
348348
Path: "/",
349349
HttpOnly: true,

‎coderd/audit.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -261,7 +261,7 @@ func (api *API) convertAuditLog(ctx context.Context, dblog database.GetAuditLogs
261261

262262
func auditLogDescription(alog database.GetAuditLogsOffsetRow, additionalFields AdditionalFields) string {
263263
str := fmt.Sprintf("{user} %s",
264-
codersdk.AuditAction(alog.Action).FriendlyString(),
264+
codersdk.AuditAction(alog.Action).Friendly(),
265265
)
266266

267267
// Strings for starting/stopping workspace builds follow the below format:

‎coderd/authorize_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ func TestCheckPermissions(t *testing.T) {
133133
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
134134
t.Cleanup(cancel)
135135

136-
resp, err := c.Client.CheckAuthorization(ctx, codersdk.AuthorizationRequest{Checks: params})
136+
resp, err := c.Client.AuthCheck(ctx, codersdk.AuthorizationRequest{Checks: params})
137137
require.NoError(t, err, "check perms")
138138
require.Equal(t, c.Check, resp)
139139
})

‎coderd/httpapi/cookie.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ func StripCoderCookies(header string) string {
2020
continue
2121
}
2222
name, _, _ := strings.Cut(part, "=")
23-
if name == codersdk.SessionTokenKey ||
24-
name == codersdk.OAuth2StateKey ||
25-
name == codersdk.OAuth2RedirectKey {
23+
if name == codersdk.SessionTokenCookie ||
24+
name == codersdk.OAuth2StateCookie ||
25+
name == codersdk.OAuth2RedirectCookie {
2626
continue
2727
}
2828
cookies = append(cookies, part)

‎coderd/httpmw/apikey.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ func ExtractAPIKey(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler {
144144
if token == "" {
145145
optionalWrite(http.StatusUnauthorized, codersdk.Response{
146146
Message: SignedOutErrorMessage,
147-
Detail: fmt.Sprintf("Cookie %q or query parameter must be provided.", codersdk.SessionTokenKey),
147+
Detail: fmt.Sprintf("Cookie %q or query parameter must be provided.", codersdk.SessionTokenCookie),
148148
})
149149
return
150150
}
@@ -364,17 +364,17 @@ func ExtractAPIKey(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler {
364364
// 4. The coder_session_token query parameter
365365
// 5. The custom auth header
366366
func apiTokenFromRequest(r *http.Request) string {
367-
cookie, err := r.Cookie(codersdk.SessionTokenKey)
367+
cookie, err := r.Cookie(codersdk.SessionTokenCookie)
368368
if err == nil && cookie.Value != "" {
369369
return cookie.Value
370370
}
371371

372-
urlValue := r.URL.Query().Get(codersdk.SessionTokenKey)
372+
urlValue := r.URL.Query().Get(codersdk.SessionTokenCookie)
373373
if urlValue != "" {
374374
return urlValue
375375
}
376376

377-
headerValue := r.Header.Get(codersdk.SessionCustomHeader)
377+
headerValue := r.Header.Get(codersdk.SessionTokenHeader)
378378
if headerValue != "" {
379379
return headerValue
380380
}

‎coderd/httpmw/apikey_test.go

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ func TestAPIKey(t *testing.T) {
8282
r = httptest.NewRequest("GET", "/", nil)
8383
rw = httptest.NewRecorder()
8484
)
85-
r.Header.Set(codersdk.SessionCustomHeader, "test-wow-hello")
85+
r.Header.Set(codersdk.SessionTokenHeader, "test-wow-hello")
8686

8787
httpmw.ExtractAPIKey(httpmw.ExtractAPIKeyConfig{
8888
DB: db,
@@ -100,7 +100,7 @@ func TestAPIKey(t *testing.T) {
100100
r = httptest.NewRequest("GET", "/", nil)
101101
rw = httptest.NewRecorder()
102102
)
103-
r.Header.Set(codersdk.SessionCustomHeader, "test-wow")
103+
r.Header.Set(codersdk.SessionTokenHeader, "test-wow")
104104

105105
httpmw.ExtractAPIKey(httpmw.ExtractAPIKeyConfig{
106106
DB: db,
@@ -118,7 +118,7 @@ func TestAPIKey(t *testing.T) {
118118
r = httptest.NewRequest("GET", "/", nil)
119119
rw = httptest.NewRecorder()
120120
)
121-
r.Header.Set(codersdk.SessionCustomHeader, "testtestid-wow")
121+
r.Header.Set(codersdk.SessionTokenHeader, "testtestid-wow")
122122

123123
httpmw.ExtractAPIKey(httpmw.ExtractAPIKeyConfig{
124124
DB: db,
@@ -137,7 +137,7 @@ func TestAPIKey(t *testing.T) {
137137
r = httptest.NewRequest("GET", "/", nil)
138138
rw = httptest.NewRecorder()
139139
)
140-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
140+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
141141

142142
httpmw.ExtractAPIKey(httpmw.ExtractAPIKeyConfig{
143143
DB: db,
@@ -157,7 +157,7 @@ func TestAPIKey(t *testing.T) {
157157
rw = httptest.NewRecorder()
158158
user = createUser(r.Context(), t, db)
159159
)
160-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
160+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
161161

162162
// Use a different secret so they don't match!
163163
hashed := sha256.Sum256([]byte("differentsecret"))
@@ -188,7 +188,7 @@ func TestAPIKey(t *testing.T) {
188188
rw = httptest.NewRecorder()
189189
user = createUser(r.Context(), t, db)
190190
)
191-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
191+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
192192

193193
_, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
194194
ID: id,
@@ -217,7 +217,7 @@ func TestAPIKey(t *testing.T) {
217217
rw = httptest.NewRecorder()
218218
user = createUser(r.Context(), t, db)
219219
)
220-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
220+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
221221

222222
sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
223223
ID: id,
@@ -259,7 +259,7 @@ func TestAPIKey(t *testing.T) {
259259
user = createUser(r.Context(), t, db)
260260
)
261261
r.AddCookie(&http.Cookie{
262-
Name: codersdk.SessionTokenKey,
262+
Name: codersdk.SessionTokenCookie,
263263
Value: fmt.Sprintf("%s-%s", id, secret),
264264
})
265265

@@ -302,7 +302,7 @@ func TestAPIKey(t *testing.T) {
302302
user = createUser(r.Context(), t, db)
303303
)
304304
q := r.URL.Query()
305-
q.Add(codersdk.SessionTokenKey, fmt.Sprintf("%s-%s", id, secret))
305+
q.Add(codersdk.SessionTokenCookie, fmt.Sprintf("%s-%s", id, secret))
306306
r.URL.RawQuery = q.Encode()
307307

308308
_, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
@@ -339,7 +339,7 @@ func TestAPIKey(t *testing.T) {
339339
rw = httptest.NewRecorder()
340340
user = createUser(r.Context(), t, db)
341341
)
342-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
342+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
343343

344344
sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
345345
ID: id,
@@ -376,7 +376,7 @@ func TestAPIKey(t *testing.T) {
376376
rw = httptest.NewRecorder()
377377
user = createUser(r.Context(), t, db)
378378
)
379-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
379+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
380380

381381
sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
382382
ID: id,
@@ -413,7 +413,7 @@ func TestAPIKey(t *testing.T) {
413413
rw = httptest.NewRecorder()
414414
user = createUser(r.Context(), t, db)
415415
)
416-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
416+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
417417

418418
sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
419419
ID: id,
@@ -457,7 +457,7 @@ func TestAPIKey(t *testing.T) {
457457
rw = httptest.NewRecorder()
458458
user = createUser(r.Context(), t, db)
459459
)
460-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
460+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
461461

462462
sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
463463
ID: id,
@@ -514,7 +514,7 @@ func TestAPIKey(t *testing.T) {
514514
user = createUser(r.Context(), t, db)
515515
)
516516
r.RemoteAddr = "1.1.1.1"
517-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
517+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
518518

519519
_, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
520520
ID: id,
@@ -602,7 +602,7 @@ func TestAPIKey(t *testing.T) {
602602
rw = httptest.NewRecorder()
603603
user = createUser(r.Context(), t, db)
604604
)
605-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
605+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
606606

607607
sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
608608
ID: id,

‎coderd/httpmw/authorize_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ func TestExtractUserRoles(t *testing.T) {
131131
})
132132

133133
req := httptest.NewRequest("GET", "/", nil)
134-
req.Header.Set(codersdk.SessionCustomHeader, token)
134+
req.Header.Set(codersdk.SessionTokenHeader, token)
135135

136136
rtr.ServeHTTP(rw, req)
137137
resp := rw.Result()

‎coderd/httpmw/csrf.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,19 +41,19 @@ func CSRF(secureCookie bool) func(next http.Handler) http.Handler {
4141
// CSRF only affects requests that automatically attach credentials via a cookie.
4242
// If no cookie is present, then there is no risk of CSRF.
4343
//nolint:govet
44-
sessCookie, err := r.Cookie(codersdk.SessionTokenKey)
44+
sessCookie, err := r.Cookie(codersdk.SessionTokenCookie)
4545
if xerrors.Is(err, http.ErrNoCookie) {
4646
return true
4747
}
4848

49-
if token := r.Header.Get(codersdk.SessionCustomHeader); token == sessCookie.Value {
49+
if token := r.Header.Get(codersdk.SessionTokenHeader); token == sessCookie.Value {
5050
// If the cookie and header match, we can assume this is the same as just using the
5151
// custom header auth. Custom header auth can bypass CSRF, as CSRF attacks
5252
// cannot add custom headers.
5353
return true
5454
}
5555

56-
if token := r.URL.Query().Get(codersdk.SessionTokenKey); token == sessCookie.Value {
56+
if token := r.URL.Query().Get(codersdk.SessionTokenCookie); token == sessCookie.Value {
5757
// If the auth is set in a url param and matches the cookie, it
5858
// is the same as just using the url param.
5959
return true

‎coderd/httpmw/oauth2.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ func ExtractOAuth2(config OAuth2Config, client *http.Client) func(http.Handler)
7171
}
7272

7373
http.SetCookie(rw, &http.Cookie{
74-
Name: codersdk.OAuth2StateKey,
74+
Name: codersdk.OAuth2StateCookie,
7575
Value: state,
7676
Path: "/",
7777
HttpOnly: true,
@@ -80,7 +80,7 @@ func ExtractOAuth2(config OAuth2Config, client *http.Client) func(http.Handler)
8080
// Redirect must always be specified, otherwise
8181
// an old redirect could apply!
8282
http.SetCookie(rw, &http.Cookie{
83-
Name: codersdk.OAuth2RedirectKey,
83+
Name: codersdk.OAuth2RedirectCookie,
8484
Value: r.URL.Query().Get("redirect"),
8585
Path: "/",
8686
HttpOnly: true,
@@ -98,10 +98,10 @@ func ExtractOAuth2(config OAuth2Config, client *http.Client) func(http.Handler)
9898
return
9999
}
100100

101-
stateCookie, err := r.Cookie(codersdk.OAuth2StateKey)
101+
stateCookie, err := r.Cookie(codersdk.OAuth2StateCookie)
102102
if err != nil {
103103
httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
104-
Message: fmt.Sprintf("Cookie %q must be provided.", codersdk.OAuth2StateKey),
104+
Message: fmt.Sprintf("Cookie %q must be provided.", codersdk.OAuth2StateCookie),
105105
})
106106
return
107107
}
@@ -113,7 +113,7 @@ func ExtractOAuth2(config OAuth2Config, client *http.Client) func(http.Handler)
113113
}
114114

115115
var redirect string
116-
stateRedirect, err := r.Cookie(codersdk.OAuth2RedirectKey)
116+
stateRedirect, err := r.Cookie(codersdk.OAuth2RedirectCookie)
117117
if err == nil {
118118
redirect = stateRedirect.Value
119119
}

‎coderd/httpmw/oauth2_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ func TestOAuth2(t *testing.T) {
7373
t.Parallel()
7474
req := httptest.NewRequest("GET", "/?code=something&state=test", nil)
7575
req.AddCookie(&http.Cookie{
76-
Name: codersdk.OAuth2StateKey,
76+
Name: codersdk.OAuth2StateCookie,
7777
Value: "mismatch",
7878
})
7979
res := httptest.NewRecorder()
@@ -84,7 +84,7 @@ func TestOAuth2(t *testing.T) {
8484
t.Parallel()
8585
req := httptest.NewRequest("GET", "/?code=test&state=something", nil)
8686
req.AddCookie(&http.Cookie{
87-
Name: codersdk.OAuth2StateKey,
87+
Name: codersdk.OAuth2StateCookie,
8888
Value: "something",
8989
})
9090
req.AddCookie(&http.Cookie{

‎coderd/httpmw/organizationparam_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func TestOrganizationParam(t *testing.T) {
2929
r = httptest.NewRequest("GET", "/", nil)
3030
hashed = sha256.Sum256([]byte(secret))
3131
)
32-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
32+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
3333

3434
userID := uuid.New()
3535
username, err := cryptorand.String(8)

‎coderd/httpmw/ratelimit_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ func TestRateLimit(t *testing.T) {
111111

112112
// Bypass must fail
113113
req := httptest.NewRequest("GET", "/", nil)
114-
req.Header.Set(codersdk.SessionCustomHeader, key)
114+
req.Header.Set(codersdk.SessionTokenHeader, key)
115115
req.Header.Set(codersdk.BypassRatelimitHeader, "true")
116116
rec := httptest.NewRecorder()
117117
// Assert we're not using IP address.
@@ -123,7 +123,7 @@ func TestRateLimit(t *testing.T) {
123123

124124
require.Eventually(t, func() bool {
125125
req := httptest.NewRequest("GET", "/", nil)
126-
req.Header.Set(codersdk.SessionCustomHeader, key)
126+
req.Header.Set(codersdk.SessionTokenHeader, key)
127127
rec := httptest.NewRecorder()
128128
// Assert we're not using IP address.
129129
req.RemoteAddr = randRemoteAddr()
@@ -160,7 +160,7 @@ func TestRateLimit(t *testing.T) {
160160

161161
require.Never(t, func() bool {
162162
req := httptest.NewRequest("GET", "/", nil)
163-
req.Header.Set(codersdk.SessionCustomHeader, key)
163+
req.Header.Set(codersdk.SessionTokenHeader, key)
164164
req.Header.Set(codersdk.BypassRatelimitHeader, "true")
165165
rec := httptest.NewRecorder()
166166
// Assert we're not using IP address.

‎coderd/httpmw/templateparam_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func TestTemplateParam(t *testing.T) {
2929
hashed = sha256.Sum256([]byte(secret))
3030
)
3131
r := httptest.NewRequest("GET", "/", nil)
32-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
32+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
3333

3434
userID := uuid.New()
3535
username, err := cryptorand.String(8)

‎coderd/httpmw/templateversionparam_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func TestTemplateVersionParam(t *testing.T) {
2929
hashed = sha256.Sum256([]byte(secret))
3030
)
3131
r := httptest.NewRequest("GET", "/", nil)
32-
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
32+
r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
3333

3434
userID := uuid.New()
3535
username, err := cryptorand.String(8)

0 commit comments

Comments
 (0)