From 857587b35d3eaff2f8a1062c9e4cfb66b786616b Mon Sep 17 00:00:00 2001 From: Bruno Quaresma Date: Thu, 8 May 2025 09:51:10 -0300 Subject: [PATCH] fix: do not share token with http app urls (#17720) It's a security issue to share the API token, and the protocols that we actually want to share it with are not HTTP and handled locally on the same machine. Security issue introduced by https://github.com/coder/coder/pull/17708 --- site/src/modules/resources/AppLink/AppLink.tsx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/site/src/modules/resources/AppLink/AppLink.tsx b/site/src/modules/resources/AppLink/AppLink.tsx index 5c4209a8f7..0e94335ba0 100644 --- a/site/src/modules/resources/AppLink/AppLink.tsx +++ b/site/src/modules/resources/AppLink/AppLink.tsx @@ -106,7 +106,11 @@ export const AppLink: FC = ({ app, workspace, agent }) => { event.preventDefault(); - if (app.external) { + // HTTP links should never need the session token, since Cookies + // handle sharing it when you access the Coder Dashboard. We should + // never be forwarding the bare session token to other domains! + const isHttp = app.url?.startsWith("http"); + if (app.external && !isHttp) { // This is a magic undocumented string that is replaced // with a brand-new session token from the backend. // This only exists for external URLs, and should only