synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-03 16:13:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Dynamic CSP connect-src to support terminals connecting to workspace proxies (#7352)

Browse Source 
* chore: Expose proxy hostnames to csp header
This commit is contained in:
Steven Masley
2023-05-02 08:30:44 -05:00
committed by GitHub
parent 465fe8658d
commit a1db82582f
6 changed files with 220 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
coderd/coderd.go
View File

@ -793,7 +793,16 @@ func New(options *Options) *API {
r.Get("/swagger/*", globalHTTPSwaggerHandler)
}
r.NotFound(compressHandler(http.HandlerFunc(api.siteHandler.ServeHTTP)).ServeHTTP)
// Add CSP headers to all static assets and pages. CSP headers only affect
// browsers, so these don't make sense on api routes.
cspMW := httpmw.CSPHeaders(func() []string {
if f := api.WorkspaceProxyHostsFn.Load(); f != nil {
return (*f)()
}
// By default we do not add extra websocket connections to the CSP
return []string{}
})
r.NotFound(cspMW(compressHandler(http.HandlerFunc(api.siteHandler.ServeHTTP))).ServeHTTP)
return api
}
@ -813,7 +822,12 @@ type API struct {
WorkspaceClientCoordinateOverride atomic.Pointer[func(rw http.ResponseWriter) bool]
TailnetCoordinator atomic.Pointer[tailnet.Coordinator]
QuotaCommitter atomic.Pointer[proto.QuotaCommitter]
TemplateScheduleStore *atomic.Pointer[schedule.TemplateScheduleStore]
// WorkspaceProxyHostsFn returns the hosts of healthy workspace proxies
// for header reasons.
WorkspaceProxyHostsFn atomic.Pointer[func() []string]
// TemplateScheduleStore is a pointer to an atomic pointer because this is
// passed to another struct, and we want them all to be the same reference.
TemplateScheduleStore *atomic.Pointer[schedule.TemplateScheduleStore]
HTTPAuth *HTTPAuthorizer