Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

feat: bypass built-in CORS handling for workspace apps#17596

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Closed
Emyrk wants to merge19 commits intomainfromstevenmasley/cors
Closed
Changes from1 commit
Commits
Show all changes
19 commits
Select commitHold shift + click to select a range
0dc7ca3
Working implementation
dannykoppingNov 21, 2024
3c0e33a
Rename CorsBehavior to CORSBehavior
dannykoppingNov 26, 2024
a4d3c8d
Hard & simplify CORORS handling logic
dannykoppingNov 27, 2024
873c3e4
Minor fixes
dannykoppingNov 27, 2024
65f984f
Appeasing the linter
dannykoppingNov 27, 2024
1f0b34c
Move type def to codersdk
dannykoppingNov 27, 2024
5be5477
Appease the linter, again
dannykoppingNov 27, 2024
ddbbaa9
Fix migration num
dannykoppingNov 28, 2024
63c1852
Removing unnecessary header check
dannykoppingNov 28, 2024
976cd78
Improve tests
dannykoppingNov 28, 2024
9f9068f
Merge branch 'main' of https://github.com/coder/coder into dk/cors
dannykoppingNov 29, 2024
3dc00e1
Comprehensive CORS test suite for both request & response
dannykoppingNov 29, 2024
5e1c6eb
Merge remote-tracking branch 'origin/main' into stevenmasley/cors
EmyrkApr 28, 2025
3266967
make gen
EmyrkApr 28, 2025
9065623
formatting
EmyrkApr 28, 2025
991d285
move cors to after app handling
EmyrkApr 29, 2025
5ba7b82
gen
EmyrkApr 29, 2025
bc8cce3
chore: work on template to test cors
EmyrkApr 29, 2025
de30a29
chore: add template to test cors behavior
EmyrkApr 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
PrevPrevious commit
NextNext commit
Improve tests
Signed-off-by: Danny Kopping <danny@coder.com>
  • Loading branch information
@dannykopping
dannykopping committedNov 28, 2024
commit976cd78d90a878bb88fd5a1d7c9cdd3a08409d0e
192 changes: 101 additions & 91 deletionscoderd/workspaceapps/apptest/apptest.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -472,7 +472,7 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
})
})

t.Run("CORS", func(t *testing.T) {
t.Run("WorkspaceApplicationCORS", func(t *testing.T) {
t.Parallel()

// Set up test headers that should be returned by the app
Expand All@@ -481,108 +481,118 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
"Access-Control-Allow-Methods": []string{"GET, POST, OPTIONS"},
}

t.Run("UnauthenticatedPassthruRejected", func(t *testing.T) {
t.Parallel()

ctx := testutil.Context(t, testutil.WaitLong)

appDetails := setupProxyTest(t, &DeploymentOptions{
headers: testHeaders,
})

// Given: an unauthenticated client
client := appDetails.AppClient(t)
client.SetSessionToken("")

// When: a request is made to an authenticated app with passthru CORS behavior
resp, err := requestWithRetries(ctx, t, client, http.MethodGet, appDetails.SubdomainAppURL(appDetails.Apps.AuthenticatedCORSPassthru).String(), nil)
require.NoError(t, err)
defer resp.Body.Close()

// Then: the request is redirected to login because even though CORS is passthru,
// the request must still be authenticated first
require.Equal(t, http.StatusSeeOther, resp.StatusCode)
gotLocation, err := resp.Location()
require.NoError(t, err)
require.Equal(t, appDetails.SDKClient.URL.Host, gotLocation.Host)
require.Equal(t, "/api/v2/applications/auth-redirect", gotLocation.Path)
})

t.Run("AuthenticatedPassthruOK", func(t *testing.T) {
t.Parallel()

ctx := testutil.Context(t, testutil.WaitLong)

appDetails := setupProxyTest(t, &DeploymentOptions{
headers: testHeaders,
})

userClient, _ := coderdtest.CreateAnotherUser(t, appDetails.SDKClient, appDetails.FirstUser.OrganizationID, rbac.RoleMember())
userAppClient := appDetails.AppClient(t)
userAppClient.SetSessionToken(userClient.SessionToken())

// Given: an authenticated app with passthru CORS behavior
resp, err := requestWithRetries(ctx, t, userAppClient, http.MethodGet, appDetails.SubdomainAppURL(appDetails.Apps.AuthenticatedCORSPassthru).String(), nil)
require.NoError(t, err)
defer resp.Body.Close()
require.Equal(t, http.StatusOK, resp.StatusCode)

// Check CORS headers are passed through
require.Equal(t, testHeaders.Get("Access-Control-Allow-Origin"), resp.Header.Get("Access-Control-Allow-Origin"))
require.Equal(t, testHeaders.Get("Access-Control-Allow-Methods"), resp.Header.Get("Access-Control-Allow-Methods"))
appDetails := setupProxyTest(t, &DeploymentOptions{
headers: testHeaders,
})

t.Run("UnauthenticatedPublicPassthruOK", func(t *testing.T) {
t.Parallel()
unauthenticatedClient := func(t *testing.T, appDetails *Details) *codersdk.Client {
c := appDetails.AppClient(t)
c.SetSessionToken("")
return c
}

ctx := testutil.Context(t, testutil.WaitLong)
authenticatedClient := func(t *testing.T, appDetails *Details) *codersdk.Client {
uc, _ := coderdtest.CreateAnotherUser(t, appDetails.SDKClient, appDetails.FirstUser.OrganizationID, rbac.RoleMember())
c := appDetails.AppClient(t)
c.SetSessionToken(uc.SessionToken())
return c
}

appDetails :=setupProxyTest(t, &DeploymentOptions{
headers: testHeaders,
})
ownerClient :=func(t *testing.T, appDetails *Details) *codersdk.Client{
return appDetails.SDKClient
}

// Given: an unauthenticated client
client := appDetails.AppClient(t)
client.SetSessionToken("")
tests := []struct {
name string
app App
client func(t *testing.T, appDetails *Details) *codersdk.Client
expectedStatusCode int
expectedCORSHeaders bool
}{
// Public
{
name: "Default/Public",
app: appDetails.Apps.PublicCORSDefault,
client: unauthenticatedClient,
expectedStatusCode: http.StatusOK,
expectedCORSHeaders: false,
},
{
name: "Passthru/Public",
app: appDetails.Apps.PublicCORSPassthru,
client: unauthenticatedClient,
expectedStatusCode: http.StatusOK,
expectedCORSHeaders: true,
},
// Authenticated
{
name: "Default/Authenticated",
app: appDetails.Apps.AuthenticatedCORSDefault,
expectedCORSHeaders: false,
client: authenticatedClient,
expectedStatusCode: http.StatusOK,
},
{
name: "Passthru/Authenticated",
app: appDetails.Apps.AuthenticatedCORSPassthru,
expectedCORSHeaders: true,
client: authenticatedClient,
expectedStatusCode: http.StatusOK,
},
{
// The CORS behavior will not affect unauthenticated requests.
// The request will be redirected to the login page.
name: "Passthru/Unauthenticated",
app: appDetails.Apps.AuthenticatedCORSPassthru,
expectedCORSHeaders: false,
client: unauthenticatedClient,
expectedStatusCode: http.StatusSeeOther,
},
// Owner
{
name: "Default/Owner",
app: appDetails.Apps.AuthenticatedCORSDefault,
expectedCORSHeaders: false,
client: ownerClient,
expectedStatusCode: http.StatusOK,
},
{
name: "Passthru/Owner",
app: appDetails.Apps.AuthenticatedCORSPassthru,
expectedCORSHeaders: true,
client: ownerClient,
expectedStatusCode: http.StatusOK,
},
}

// When: a request is made to a public app with passthru CORS behavior
resp, err := requestWithRetries(ctx, t, client, http.MethodGet, appDetails.SubdomainAppURL(appDetails.Apps.PublicCORSPassthru).String(), nil)
require.NoError(t, err)
defer resp.Body.Close()
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()

// Then: the request succeeds because the app is public
require.Equal(t, http.StatusOK, resp.StatusCode)
ctx := testutil.Context(t, testutil.WaitLong)

// Check CORS headers are passed through
require.Equal(t, testHeaders.Get("Access-Control-Allow-Origin"), resp.Header.Get("Access-Control-Allow-Origin"))
require.Equal(t, testHeaders.Get("Access-Control-Allow-Methods"), resp.Header.Get("Access-Control-Allow-Methods"))
})
// Given: a client
client := tc.client(t, appDetails)

t.Run("AuthenticatedPublicPassthruOK", func(t *testing.T) {
t.Parallel()
// When: a request is made to an authenticated app with a specified CORS behavior
resp, err := requestWithRetries(ctx, t, client, http.MethodGet, appDetails.SubdomainAppURL(tc.app).String(), nil)
require.NoError(t, err)
defer resp.Body.Close()

ctx := testutil.Context(t, testutil.WaitLong)
// Then: the request must match expectations
require.Equal(t, tc.expectedStatusCode, resp.StatusCode)
require.NoError(t, err)

appDetails := setupProxyTest(t, &DeploymentOptions{
headers: testHeaders,
// Then: the CORS headers must match expectations
if tc.expectedCORSHeaders {
require.Equal(t, testHeaders.Get("Access-Control-Allow-Origin"), resp.Header.Get("Access-Control-Allow-Origin"))
require.Equal(t, testHeaders.Get("Access-Control-Allow-Methods"), resp.Header.Get("Access-Control-Allow-Methods"))
} else {
require.Empty(t, resp.Header.Get("Access-Control-Allow-Origin"))
require.Empty(t, resp.Header.Get("Access-Control-Allow-Methods"))
}
})

userClient, _ := coderdtest.CreateAnotherUser(t, appDetails.SDKClient, appDetails.FirstUser.OrganizationID, rbac.RoleMember())
userAppClient := appDetails.AppClient(t)
userAppClient.SetSessionToken(userClient.SessionToken())

// Given: an authenticated client accessing a public app with passthru CORS behavior
resp, err := requestWithRetries(ctx, t, userAppClient, http.MethodGet, appDetails.SubdomainAppURL(appDetails.Apps.PublicCORSPassthru).String(), nil)
require.NoError(t, err)
defer resp.Body.Close()

// Then: the request succeeds because the app is public
require.Equal(t, http.StatusOK, resp.StatusCode)

// Check CORS headers are passed through
require.Equal(t, testHeaders.Get("Access-Control-Allow-Origin"), resp.Header.Get("Access-Control-Allow-Origin"))
require.Equal(t, testHeaders.Get("Access-Control-Allow-Methods"), resp.Header.Get("Access-Control-Allow-Methods"))
})
}
})

t.Run("WorkspaceApplicationAuth", func(t *testing.T) {
Expand Down
Loading
[8]ページ先頭
©2009-2025 Movatter.jp