feat: use a custom cookie name for devurls to avoid clashes

coder · deansheather · Sep 22, 2022 · Sep 19, 2022 · Sep 19, 2022 · Sep 19, 2022
commit 16bbcbe5f6ca1d3e4b90cff60d333afd90cf265e
diff --git a/coderd/httpmw/apikey.go b/coderd/httpmw/apikey.go
@@ -23,6 +23,11 @@ import (
 	"github.com/coder/coder/codersdk"
 )
 
+// The special cookie name used for subdomain-based application proxying.
+// TODO: this will make dogfooding harder so come up with a more unique
+// solution
+const DevURLSessionTokenCookie = "coder_devurl_session_token"
+
 type apiKeyContextKey struct{}
 
 // APIKeyOptional may return an API key from the ExtractAPIKey handler.
@@ -347,15 +352,21 @@ func ExtractAPIKey(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler {
 // apiTokenFromRequest returns the api token from the request.
 // Find the session token from:
 // 1: The cookie
-// 2: The old cookie
-// 3. The coder_session_token query parameter
-// 4. The custom auth header
+// 1: The devurl cookie
+// 3: The old cookie
+// 4. The coder_session_token query parameter
+// 5. The custom auth header
 func apiTokenFromRequest(r *http.Request) string {
 	cookie, err := r.Cookie(codersdk.SessionTokenKey)
 	if err == nil && cookie.Value != "" {
 		return cookie.Value
 	}
 
+	cookie, err = r.Cookie(DevURLSessionTokenCookie)
+	if err == nil && cookie.Value != "" {
+		return cookie.Value
+	}
+
 	// TODO: @emyrk in October 2022, remove this oldCookie check.
 	//	This is just to support the old cli for 1 release. Then everyone
 	//	must update.

diff --git a/coderd/workspaceapps.go b/coderd/workspaceapps.go
@@ -248,9 +248,10 @@ func (api *API) verifyWorkspaceApplicationAuth(rw http.ResponseWriter, r *http.R
 			return false
 		}
 
-		// Set the cookie for all subdomains of api.AppHostname.
+		// Set the app cookie for all subdomains of api.AppHostname. This cookie
+		// is handled properly by the ExtractAPIKey middleware.
 		http.SetCookie(rw, &http.Cookie{
-			Name:     codersdk.SessionTokenKey,
+			Name:     httpmw.DevURLSessionTokenCookie,
 			Value:    apiKey,
 			Domain:   "." + api.AppHostname,
 			Path:     "/",