Skip to content

feat: bypass built-in CORS handling for workspace apps #17596

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 19 commits into from
Closed
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Move type def to codersdk
Signed-off-by: Danny Kopping <danny@coder.com>
  • Loading branch information
dannykopping committed Nov 28, 2024
commit 1f0b34c178bd759ba36ea66bc69388f8731f4925
7 changes: 3 additions & 4 deletions coderd/workspaceapps/apptest/setup.go
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,6 @@ import (
"github.com/coder/coder/v2/coderd/coderdtest"
"github.com/coder/coder/v2/coderd/workspaceapps"
"github.com/coder/coder/v2/coderd/workspaceapps/appurl"
"github.com/coder/coder/v2/coderd/workspaceapps/cors"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/codersdk/agentsdk"
"github.com/coder/coder/v2/cryptorand"
Expand Down Expand Up @@ -102,7 +101,7 @@ type App struct {
Path string

// Control the behavior of CORS handling.
CORSBehavior cors.AppCORSBehavior
CORSBehavior codersdk.AppCORSBehavior
}

// Details are the full test details returned from setupProxyTestWithFactory.
Expand Down Expand Up @@ -271,15 +270,15 @@ func setupProxyTestWithFactory(t *testing.T, factory DeploymentFactory, opts *De
WorkspaceName: workspace.Name,
AgentName: agnt.Name,
AppSlugOrPort: proxyTestAppNamePublicCORSPassthru,
CORSBehavior: cors.AppCORSBehaviorPassthru,
CORSBehavior: codersdk.AppCORSBehaviorPassthru,
Query: proxyTestAppQuery,
}
details.Apps.AuthenticatedCORSPassthru = App{
Username: me.Username,
WorkspaceName: workspace.Name,
AgentName: agnt.Name,
AppSlugOrPort: proxyTestAppNameAuthenticatedCORSPassthru,
CORSBehavior: cors.AppCORSBehaviorPassthru,
CORSBehavior: codersdk.AppCORSBehaviorPassthru,
Query: proxyTestAppQuery,
}
details.Apps.PublicCORSDefault = App{
Expand Down
15 changes: 6 additions & 9 deletions coderd/workspaceapps/cors/cors.go
Original file line number Diff line number Diff line change
@@ -1,24 +1,21 @@
package cors

import "context"
import (
"context"

type AppCORSBehavior string

const (
AppCORSBehaviorSimple AppCORSBehavior = "simple"
AppCORSBehaviorPassthru AppCORSBehavior = "passthru"
"github.com/coder/coder/v2/codersdk"
)

type contextKeyBehavior struct{}

// WithBehavior sets the CORS behavior for the given context.
func WithBehavior(ctx context.Context, behavior AppCORSBehavior) context.Context {
func WithBehavior(ctx context.Context, behavior codersdk.AppCORSBehavior) context.Context {
return context.WithValue(ctx, contextKeyBehavior{}, behavior)
}

// HasBehavior returns true if the given context has the specified CORS behavior.
func HasBehavior(ctx context.Context, behavior AppCORSBehavior) bool {
func HasBehavior(ctx context.Context, behavior codersdk.AppCORSBehavior) bool {
val := ctx.Value(contextKeyBehavior{})
b, ok := val.(AppCORSBehavior)
b, ok := val.(codersdk.AppCORSBehavior)
return ok && b == behavior
}
3 changes: 1 addition & 2 deletions coderd/workspaceapps/db.go
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ import (
"github.com/coder/coder/v2/coderd/jwtutils"
"github.com/coder/coder/v2/coderd/rbac"
"github.com/coder/coder/v2/coderd/rbac/policy"
"github.com/coder/coder/v2/coderd/workspaceapps/cors"
"github.com/coder/coder/v2/codersdk"
)

Expand Down Expand Up @@ -132,7 +131,7 @@ func (p *DBTokenProvider) Issue(ctx context.Context, rw http.ResponseWriter, r *
if dbReq.AppURL != nil {
token.AppURL = dbReq.AppURL.String()
}
token.CORSBehavior = cors.AppCORSBehavior(dbReq.AppCORSBehavior)
token.CORSBehavior = codersdk.AppCORSBehavior(dbReq.AppCORSBehavior)

// Verify the user has access to the app.
authed, warnings, err := p.authorizeRequest(r.Context(), authz, dbReq)
Expand Down
6 changes: 3 additions & 3 deletions coderd/workspaceapps/proxy.go
Original file line number Diff line number Diff line change
Expand Up @@ -441,7 +441,7 @@ func (s *Server) determineCORSBehavior(token *SignedToken, app appurl.Applicatio
corsHandler := httpmw.WorkspaceAppCors(s.HostnameRegex, app)(next)

return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
var behavior cors.AppCORSBehavior
var behavior codersdk.AppCORSBehavior
if token != nil {
behavior = token.CORSBehavior
}
Expand All @@ -452,7 +452,7 @@ func (s *Server) determineCORSBehavior(token *SignedToken, app appurl.Applicatio
r = r.WithContext(cors.WithBehavior(r.Context(), behavior))

switch behavior {
case cors.AppCORSBehaviorPassthru:
case codersdk.AppCORSBehaviorPassthru:
// Bypass the CORS middleware.
next.ServeHTTP(rw, r)
return
Expand Down Expand Up @@ -595,7 +595,7 @@ func (s *Server) proxyWorkspaceApp(rw http.ResponseWriter, r *http.Request, appT

proxy.ModifyResponse = func(r *http.Response) error {
// If passthru behavior is set, disable our CORS header stripping.
if cors.HasBehavior(r.Request.Context(), cors.AppCORSBehaviorPassthru) {
if cors.HasBehavior(r.Request.Context(), codersdk.AppCORSBehaviorPassthru) {
return nil
}

Expand Down
3 changes: 1 addition & 2 deletions coderd/workspaceapps/token.go
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@ import (

"github.com/coder/coder/v2/coderd/cryptokeys"
"github.com/coder/coder/v2/coderd/jwtutils"
"github.com/coder/coder/v2/coderd/workspaceapps/cors"
"github.com/coder/coder/v2/codersdk"
)

Expand All @@ -27,7 +26,7 @@ type SignedToken struct {
WorkspaceID uuid.UUID `json:"workspace_id"`
AgentID uuid.UUID `json:"agent_id"`
AppURL string `json:"app_url"`
CORSBehavior cors.AppCORSBehavior `json:"cors_behavior"`
CORSBehavior codersdk.AppCORSBehavior `json:"cors_behavior"`
}

// MatchesRequest returns true if the token matches the request. Any token that
Expand Down
17 changes: 17 additions & 0 deletions codersdk/cors_behavior.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
package codersdk

import "golang.org/x/xerrors"

type AppCORSBehavior string

const (
AppCORSBehaviorSimple AppCORSBehavior = "simple"
AppCORSBehaviorPassthru AppCORSBehavior = "passthru"
)

func (c AppCORSBehavior) Validate() error {
if c != AppCORSBehaviorSimple && c != AppCORSBehaviorPassthru {
return xerrors.New("Invalid CORS behavior.")
}
return nil
}