- Notifications
You must be signed in to change notification settings - Fork1.1k
feat: add proxy authorization to aibridgeproxyd#21342
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:ssncferreira/feat-add-aiproxy-core
Are you sure you want to change the base?
feat: add proxy authorization to aibridgeproxyd#21342
Conversation
ssncferreira commentedDec 19, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stackon Graphite.
This stack of pull requests is managed byGraphite. Learn more aboutstacking. |
8723f13 to43258dbCompare| slog.F("host",host), | ||
| slog.F("port",port), | ||
| ) | ||
| // return goproxy.RejectConnect, host |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Note: this port restriction makes it harder to test, as the test useshttptest.NewTLSServer, which picks a random port, but this rejects anything that's not port 80 or 443. Should we apply this restriction check only to known AI provider hosts?
43258db toe956851Comparefdd4a44 toe4d1ca1Comparee956851 to5b8fc18Comparee4d1ca1 toca7e3a6Compare5b8fc18 to23485a1Compare
Uh oh!
There was an error while loading.Please reload this page.
Description
This PR adds proxy authorization to the AI Bridge Proxy server. Clients provide their Coder session token via the proxy password field on the HTTP Proxy settings (
HTTPS_PROXY=http://ignored:<coder-session-token>@host:port), which is then used for forwarding to aibridged to handle authorization.Changes
Proxy-Authorizationheader during CONNECTctx.UserDatafor downstream request handlersAddr()method to get the actual listening address (useful for tests with port 0)Related to:coder/internal#1181