Skip to content

feat: secure and cross-domain subdomain-based proxying #4136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 24 commits into from
Sep 22, 2022
Merged

feat: secure and cross-domain subdomain-based proxying #4136

merged 24 commits into from
Sep 22, 2022

Conversation

deansheather
Copy link
Member

@deansheather deansheather commented Sep 20, 2022 •
edited
Loading

  • Enables running subdomain apps on a different domain instead of underneath the coder subdomain.
  • Enables configuration of the app domain (defaults to disabled).
  • Adds a new "optional" mode to ExtractAPIKey and turn the parameters into a struct.
  • Adds an auth redirection flow to authenticate into the app domain while avoiding phishing etc.
    • Unauthenticated requests to devurls get redirected to /api/v2/applications/auth-redirect?redirect_uri=...
      • Redirects to the login page (with redirect query parameter set) if the user is not logged in
      • Validates the redirect_uri to avoid redirecting to insecure domains
      • Generates a new API key scoped to only devurl access
      • Encrypts the API key with it's own hashed secret
      • Redirects to ?redirect_uri=x with ?coder_application_api_key_...=$encrypted_key
    • Requests to devurls with ?coder_application_api_key get intercepted and not proxied
      • Decrypt the API key and ensure it's valid
      • Store it as a cookie on .apps.coder.com
      • Redirect to the same URL without the query parameters
  • Adds thorough testing for:
    • API key encryption
    • API key generation (with permissions checks)
    • API key validation
  • Adds /api/v2/authcheck because I wanted to use it in a test.
  • Deletes /api/v2/users/:userid/authorization in favor of the above

The new auth flow looks like this from a network perspective:
image

TODO:

  • Documentation (probably future PR)
  • Support for multiple certificates in coder server (and helm chart) (probably in another PR)
  • Manual testing in multiple browsers
  • UI (future PR)

@deansheather deansheather marked this pull request as ready for review September 21, 2022 02:15
@deansheather deansheather requested a review from a team as a code owner September 21, 2022 02:15
@deansheather deansheather requested review from jsjoeio and removed request for a team September 21, 2022 02:15
@deansheather deansheather changed the title feat: scoped session tokens for subdomain-based proxying feat: secure and cross-domain subdomain-based proxying Sep 21, 2022
@Emyrk
Copy link
Member

Emyrk commented Sep 21, 2022

Using the secret as the key works well 👍. Just make sure to comment the hash should be treated as a secret.

kylecarbs
kylecarbs reviewed Sep 21, 2022
View reviewed changes
Copy link
Member

@kylecarbs kylecarbs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did a thorough review, and I'm impressed with what you came up with. This implementation is very clean. Bravo! Just a few questions before merge.

coderd/workspace_apps_internal_test.go Outdated
keyID, _, hashedSecret, data := generateAPIKey(t, db)
insertAPIKey(t, db, keyID, hashedSecret)

encrypted, err := encryptAPIKey(data)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What are your thoughts on moving encryptAPIKey and decryptAPIKey into a new package like appwildcard or something and moving associated helper functions there? I like all the code, but I'm worried that someone exploring the coderd package may not understand when or why we need to encrypt/decrypt keys.

Copy link
Member Author

@deansheather deansheather Sep 21, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A problem we had in v1 was that the devurls code was split across many different places. I'd like to avoid that if possible in v2 by keeping all of the code in one place.

I've added a comment above each of these functions, does that solve the problem?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair enough, that code wasn't consolidated well. Seems good to me!

@jsjoeio
Copy link
Contributor

jsjoeio commented Sep 21, 2022

Manual testing in multiple browsers

Why not do this using Playwright which supports multiple browsers?

Emyrk
Emyrk reviewed Sep 21, 2022
View reviewed changes
jsjoeio
jsjoeio reviewed Sep 21, 2022
View reviewed changes
Copy link
Contributor

@jsjoeio jsjoeio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From a FE view, all looks good 👍🏼

coadler
coadler reviewed Sep 21, 2022
View reviewed changes
@deansheather deansheather enabled auto-merge (squash) September 22, 2022 22:15
@deansheather deansheather merged commit 6deef06 into main Sep 22, 2022
@deansheather deansheather deleted the dean/app-tokens branch September 22, 2022 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jsjoeio jsjoeio jsjoeio left review comments

@Emyrk Emyrk Emyrk left review comments

@coadler coadler coadler approved these changes

@kylecarbs kylecarbs kylecarbs approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@deansheather @Emyrk @jsjoeio @coadler @kylecarbs