NotificationsYou must be signed in to change notification settings
Fork1k
Star11.1k

chore: override codersdk.SessionTokenCookie in develop.sh#18991

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

johnstcn merged 7 commits intomainfromcj/dev-session-token-cookie-prefix

Jul 23, 2025

Merged

chore: override codersdk.SessionTokenCookie in develop.sh#18991

johnstcn merged 7 commits intomainfromcj/dev-session-token-cookie-prefix

Jul 23, 2025

Conversation

Copy link

Member

johnstcn commentedJul 22, 2025•
edited
Loading

Enables viewing the Coder UI proxied by Coder.
Exposes an environment variableCODER_DEV_SESSION_TOKEN_COOKIE_PREFIX which allows adding a prefix to the name of the session token cookie. This only works for development builds.

$ CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX=dev ./scripts/develop.sh

$ curl 'https://3000--dev--nonix--cian--apps.dev.coder.com/api/v2/users/me' -H "Cookie: dev_coder_session_token=$(cat .coderv2/session)"{"id":"fddc81ff-7924-4628-a146-b799d2fb81b4","username":"admin","name":"Admin User","email":"admin@coder.com","created_at":"2025-07-22T13:39:16.670833+01:00","updated_at":"2025-07-22T17:49:38.313364+01:00","last_seen_at":"2025-07-22T16:49:38.313364Z","status":"active","login_type":"password","organization_ids":["c56e87ca-effa-43a6-a464-f25840a47483"],"roles":[{"name":"owner","display_name":"Owner"}]}

EDIT: I tried an alternative implementation instead using-ldflags -X that removes the need for most changes in codersdk.

johnstcn added3 commits

July 22, 2025 16:55

feat: allow prefixing coder_session_token cookie

9ce2437

chore: add dev.coder.com to vite allowedHosts

5497686

chore: set CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX in develop.sh

5868b0b

johnstcn self-assigned this

Jul 22, 2025

johnstcn changed the title~~Cj/dev session token cookie prefix~~chore: add CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX in development mode

Jul 22, 2025

johnstcn requested review fromcode-asher,mtojek andEmyrk

July 22, 2025 17:03

johnstcn commented

Jul 22, 2025

View reviewed changes

site/vite.config.mts

		},
		},
		allowedHosts:[".coder"],
		allowedHosts:[".coder",".dev.coder.com"],

Copy link

MemberAuthor

johnstcnJul 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

review: also updatedallowedHosts for dev URLs.

johnstcn commented

Jul 22, 2025

View reviewed changes

scripts/develop.sh Outdated


		cdroot
		DEBUG_DELVE="${debug}" start_cmd API"""${CODER_DEV_SHIM}" server --http-address 0.0.0.0:3000 --swagger-enable --access-url"${CODER_DEV_ACCESS_URL}" --dangerous-allow-cors-requests=true --enable-terraform-debug-mode"$@"
		DEBUG_DELVE="${debug}"CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX="${CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX}"start_cmd API"""${CODER_DEV_SHIM}" server --http-address 0.0.0.0:3000 --swagger-enable --access-url"${CODER_DEV_ACCESS_URL}" --dangerous-allow-cors-requests=true --enable-terraform-debug-mode"$@"

Copy link

MemberAuthor

johnstcnJul 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

review: I'm setting the prefix todev_ by default indevelop.sh.

code-asher approved these changes

Jul 22, 2025

View reviewed changes

Copy link

Member

code-asher left a comment•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I tried it out and it is glorious we can run Coder over dev URLs now 🎉

Too bad we cannot get rid ofcodersdk.SessionTokenCookie or set it dynamically (at least not as a const), but what can ya do.

Emyrk reviewed

Jul 22, 2025

View reviewed changes

codersdk/client.go Outdated

Comment on lines 109 to 116

		funcGetSessionTokenCookie()string {
		ifbuildinfo.IsDev() {
		ifpfx,found:=os.LookupEnv("CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX");found&&pfx!="" {
		returnpfx+"_"+SessionTokenCookie
		}
		}
		returnSessionTokenCookie
		}

Copy link

Member

EmyrkJul 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

ShouldSessionTokenCookie just be avar? And a function updates the var?

At the very least,SessionTokenCookie should probably not be exported. Just this function

Copy link

MemberAuthor

johnstcnJul 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Yeah I was thinking of doing that but didn't want to make a breaking API change.
But you got me thinking... what do we do forbuildinfo.tag?
If I changeSessionTokenCookie to avar we can just do the-ldflags -X trick and not have to change anything else :)

Copy link

Member

bpmct commentedJul 22, 2025

woooooooooo!!!!

johnstcn added2 commits

July 22, 2025 22:23

Revert "feat: allow prefixing coder_session_token cookie"

6c86d8c

This reverts commit9ce2437.

chore: use ldflags to override codersdk.SessionTokenCookie at build

a2dcf61

johnstcn commented

Jul 22, 2025

View reviewed changes

site/src/api/typesGenerated.ts

Comment on lines -2703 to -2705

		// From codersdk/client.go
		exportconstSessionTokenCookie="coder_session_token";

Copy link

MemberAuthor

johnstcnJul 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This isn't intentional; I need to figure out how to keep this around.
@Emyrk think it's possible to modify this behaviour inapitypings?

Copy link

MemberAuthor

johnstcnJul 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

For now I'm manually vendoring this intoapi.ts.

johnstcn commented

Jul 22, 2025

View reviewed changes

scripts/build_go.sh

Comment on lines +153 to +158

		if [["$develop_in_coder"== 1 ]];then
		echo"INFO : Overriding codersdk.SessionTokenCookie as we are developing inside a Coder workspace."
		ldflags+=(
		-X"'github.com/coder/coder/v2/codersdk.SessionTokenCookie=dev_coder_session_token'"
		)
		fi

Copy link

MemberAuthor

johnstcnJul 22, 2025•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I decided to try this way instead. It's a little more involved but requires less code changes incodersdk. I can remove the echo message if it's annoying.

johnstcn changed the title~~chore: add CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX in development mode~~chore: override codersdk.SessionTokenCookie in develop.sh

Jul 22, 2025

mtojek approved these changes

Jul 23, 2025

View reviewed changes

Copy link

Member

mtojek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Excellent!!

re-add missing autogenerated export manually

cb6b8b3

mtojek approved these changes

Jul 23, 2025

View reviewed changes

make knip shut up

f4e5a14

johnstcn commented

Jul 23, 2025

View reviewed changes

site/src/api/api.ts

Comment on lines +110 to +115

		/**
		* Originally from codersdk/client.go.
		* The below declaration is required to stop Knip from complaining.
		*@public
		*/
		exportconstSessionTokenCookie="coder_session_token";