mirror of
https://github.com/coder/coder.git
synced 2025-07-03 16:13:58 +00:00
chore: move agent functions from codersdk
into agentsdk
(#5903)
* chore: rename `AgentConn` to `WorkspaceAgentConn` The codersdk was becoming bloated with consts for the workspace agent that made no sense to a reader. `Tailnet*` is an example of these consts. * chore: remove `Get` prefix from *Client functions * chore: remove `BypassRatelimits` option in `codersdk.Client` It feels wrong to have this as a direct option because it's so infrequently needed by API callers. It's better to directly modify headers in the two places that we actually use it. * Merge `appearance.go` and `buildinfo.go` into `deployment.go` * Merge `experiments.go` and `features.go` into `deployment.go` * Fix `make gen` referencing old type names * Merge `error.go` into `client.go` `codersdk.Response` lived in `error.go`, which is wrong. * chore: refactor workspace agent functions into agentsdk It was odd conflating the codersdk that clients should use with functions that only the agent should use. This separates them into two SDKs that are closely coupled, but separate. * Merge `insights.go` into `deployment.go` * Merge `organizationmember.go` into `organizations.go` * Merge `quota.go` into `workspaces.go` * Rename `sse.go` to `serversentevents.go` * Rename `codersdk.WorkspaceAppHostResponse` to `codersdk.AppHostResponse` * Format `.vscode/settings.json` * Fix outdated naming in `api.ts` * Fix app host response * Fix unsupported type * Fix imported type
This commit is contained in:
@ -41,19 +41,19 @@ func CSRF(secureCookie bool) func(next http.Handler) http.Handler {
|
||||
// CSRF only affects requests that automatically attach credentials via a cookie.
|
||||
// If no cookie is present, then there is no risk of CSRF.
|
||||
//nolint:govet
|
||||
sessCookie, err := r.Cookie(codersdk.SessionTokenKey)
|
||||
sessCookie, err := r.Cookie(codersdk.SessionTokenCookie)
|
||||
if xerrors.Is(err, http.ErrNoCookie) {
|
||||
return true
|
||||
}
|
||||
|
||||
if token := r.Header.Get(codersdk.SessionCustomHeader); token == sessCookie.Value {
|
||||
if token := r.Header.Get(codersdk.SessionTokenHeader); token == sessCookie.Value {
|
||||
// If the cookie and header match, we can assume this is the same as just using the
|
||||
// custom header auth. Custom header auth can bypass CSRF, as CSRF attacks
|
||||
// cannot add custom headers.
|
||||
return true
|
||||
}
|
||||
|
||||
if token := r.URL.Query().Get(codersdk.SessionTokenKey); token == sessCookie.Value {
|
||||
if token := r.URL.Query().Get(codersdk.SessionTokenCookie); token == sessCookie.Value {
|
||||
// If the auth is set in a url param and matches the cookie, it
|
||||
// is the same as just using the url param.
|
||||
return true
|
||||
|
Reference in New Issue
Block a user