- Notifications
You must be signed in to change notification settings - Fork907
feat: bypass built-in CORS handling for workspace apps#15669
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
| @@ -395,41 +397,73 @@ func (s *Server) HandleSubdomain(middlewares ...func(http.Handler) http.Handler) | |||
| return | |||
| } | |||
| // Use the passed in app middlewares before checking authentication and | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Note to reviewers: this is the meat of the change.
I had to move some things around here since the token was only being createdafter CORS was handled, and the defined behavior is stored in the token.
I moved the CORS middleware invocation intodetermineCORSBehavior because we needed to conditionally invoke it if behavior !=passthru, only.
c5c74d1 toec3bac6Compare4c6beb5 tof91f220CompareSigned-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Signed-off-by: Danny Kopping <danny@coder.com>
Reopening; this has been deprioritized slightly but not forgotten. |
Uh oh!
There was an error while loading.Please reload this page.
NOTE: this PR isblocked; we want to first introduce this feature to port shares, as it has transpired that that use-case is far more common. It would be awkward to get this PR into the next release but not for port shares, so we're keeping this one on hold.
This PR introduces a partial fix for#15096; it allows operators to specify the CORS behavior on a per-
coder_applevel.This change requires
cors_behaviorto be set on a givencoder_app;coder/terraform-provider-coder#309 introduces that new attribute.coderdcurrently handles CORS automatically by handling preflight requests and stripping CORS headers from upstreamcoder_appresponses.Two CORS behaviors are defined in this PR:
simple: the current behavior of handling CORS withincoderdpassthru:new behavior which transparently bypasses our CORS handling incoderdso thecoder_appservice is then fully responsible for handling CORSWe plan to further add this behavior toport shares.
The sharing level (
owner,authenticated,public) is still respected, regardless of CORS behavior.