From b0f35316daf2eb2da37c375a6a904e3991688ae7 Mon Sep 17 00:00:00 2001 From: Steven Masley Date: Fri, 20 Feb 2026 10:33:37 -0600 Subject: [PATCH] chore!: automatically use secure cookies if using https access-url (#22198) `--secure-auth-cookie` now automatically sources it's default value from `--access-url` If the access url uses HTTPS, secure is set to `true`. To revert to old behavior, set the value explicitly to `false` --- cli/server_test.go | 12 ++++++++++++ cli/testdata/coder_server_--help.golden | 2 +- cli/testdata/server-config.yaml.golden | 2 +- coderd/apidoc/docs.go | 2 +- coderd/apidoc/swagger.json | 2 +- codersdk/deployment.go | 3 +++ docs/reference/api/schemas.md | 2 +- enterprise/cli/testdata/coder_server_--help.golden | 2 +- go.mod | 2 +- go.sum | 4 ++-- site/src/api/typesGenerated.ts | 1 + 11 files changed, 25 insertions(+), 9 deletions(-) diff --git a/cli/server_test.go b/cli/server_test.go index 80333fc7f1..da82fdb7ac 100644 --- a/cli/server_test.go +++ b/cli/server_test.go @@ -1740,6 +1740,18 @@ func TestServer(t *testing.T) { // Next, we instruct the same server to display the YAML config // and then save it. + // Because this is literally the same invocation, DefaultFn sets the + // value of 'Default'. Which triggers a mutually exclusive error + // on the next parse. + // Usually we only parse flags once, so this is not an issue + for _, c := range inv.Command.Children { + if c.Name() == "server" { + for i := range c.Options { + c.Options[i].DefaultFn = nil + } + break + } + } inv = inv.WithContext(testutil.Context(t, testutil.WaitMedium)) //nolint:gocritic inv.Args = append(args, "--write-config") diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden index 19aaa546dd..7143abf16a 100644 --- a/cli/testdata/coder_server_--help.golden +++ b/cli/testdata/coder_server_--help.golden @@ -383,7 +383,7 @@ NETWORKING OPTIONS: --samesite-auth-cookie lax|none, $CODER_SAMESITE_AUTH_COOKIE (default: lax) Controls the 'SameSite' property is set on browser session cookies. - --secure-auth-cookie bool, $CODER_SECURE_AUTH_COOKIE + --secure-auth-cookie bool, $CODER_SECURE_AUTH_COOKIE (default: false) Controls if the 'Secure' property is set on browser session cookies. --wildcard-access-url string, $CODER_WILDCARD_ACCESS_URL diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden index 39666df533..d8f342c2ed 100644 --- a/cli/testdata/server-config.yaml.golden +++ b/cli/testdata/server-config.yaml.golden @@ -176,7 +176,7 @@ networking: # (default: , type: string-array) proxyTrustedOrigins: [] # Controls if the 'Secure' property is set on browser session cookies. - # (default: , type: bool) + # (default: false, type: bool) secureAuthCookie: false # Controls the 'SameSite' property is set on browser session cookies. # (default: lax, type: enum[lax\|none]) diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go index b76254f2fd..810fb23cc4 100644 --- a/coderd/apidoc/docs.go +++ b/coderd/apidoc/docs.go @@ -22875,7 +22875,7 @@ const docTemplate = `{ ] }, "default": { - "description": "Default is parsed into Value if set.", + "description": "Default is parsed into Value if set.\nMust be ` + "`" + `\"\"` + "`" + ` if ` + "`" + `DefaultFn` + "`" + ` != nil", "type": "string" }, "description": { diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json index a8b515d967..7aa22c553d 100644 --- a/coderd/apidoc/swagger.json +++ b/coderd/apidoc/swagger.json @@ -21045,7 +21045,7 @@ ] }, "default": { - "description": "Default is parsed into Value if set.", + "description": "Default is parsed into Value if set.\nMust be `\"\"` if `DefaultFn` != nil", "type": "string" }, "description": { diff --git a/codersdk/deployment.go b/codersdk/deployment.go index 6a5a68c102..85ce2ea255 100644 --- a/codersdk/deployment.go +++ b/codersdk/deployment.go @@ -2890,6 +2890,9 @@ func (c *DeploymentValues) Options() serpent.OptionSet { Description: "Controls if the 'Secure' property is set on browser session cookies.", Flag: "secure-auth-cookie", Env: "CODER_SECURE_AUTH_COOKIE", + DefaultFn: func() string { + return strconv.FormatBool(c.AccessURL.Scheme == "https") + }, Value: &c.HTTPCookies.Secure, Group: &deploymentGroupNetworking, YAML: "secureAuthCookie", diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md index a7958f239d..65c2bc0781 100644 --- a/docs/reference/api/schemas.md +++ b/docs/reference/api/schemas.md @@ -14123,7 +14123,7 @@ None | Name | Type | Required | Restrictions | Description | |------------------|--------------------------------------------|----------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------| | `annotations` | [serpent.Annotations](#serpentannotations) | false | | Annotations enable extensions to serpent higher up in the stack. It's useful for help formatting and documentation generation. | -| `default` | string | false | | Default is parsed into Value if set. | +| `default` | string | false | | Default is parsed into Value if set. Must be `""` if `DefaultFn` != nil | | `description` | string | false | | | | `env` | string | false | | Env is the environment variable used to configure this option. If unset, environment configuring is disabled. | | `flag` | string | false | | Flag is the long name of the flag used to configure this option. If unset, flag configuring is disabled. | diff --git a/enterprise/cli/testdata/coder_server_--help.golden b/enterprise/cli/testdata/coder_server_--help.golden index 485b493b35..b602cb93a1 100644 --- a/enterprise/cli/testdata/coder_server_--help.golden +++ b/enterprise/cli/testdata/coder_server_--help.golden @@ -384,7 +384,7 @@ NETWORKING OPTIONS: --samesite-auth-cookie lax|none, $CODER_SAMESITE_AUTH_COOKIE (default: lax) Controls the 'SameSite' property is set on browser session cookies. - --secure-auth-cookie bool, $CODER_SECURE_AUTH_COOKIE + --secure-auth-cookie bool, $CODER_SECURE_AUTH_COOKIE (default: false) Controls if the 'Secure' property is set on browser session cookies. --wildcard-access-url string, $CODER_WILDCARD_ACCESS_URL diff --git a/go.mod b/go.mod index fceb6db49e..2b6046f9f9 100644 --- a/go.mod +++ b/go.mod @@ -101,7 +101,7 @@ require ( github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 github.com/coder/quartz v0.3.0 github.com/coder/retry v1.5.1 - github.com/coder/serpent v0.13.0 + github.com/coder/serpent v0.14.0 github.com/coder/terraform-provider-coder/v2 v2.13.1 github.com/coder/websocket v1.8.14 github.com/coder/wgtunnel v0.2.0 diff --git a/go.sum b/go.sum index fb86340baa..5fd1300fcd 100644 --- a/go.sum +++ b/go.sum @@ -959,8 +959,8 @@ github.com/coder/quartz v0.3.0 h1:bUoSEJ77NBfKtUqv6CPSC0AS8dsjqAqqAv7bN02m1mg= github.com/coder/quartz v0.3.0/go.mod h1:BgE7DOj/8NfvRgvKw0jPLDQH/2Lya2kxcTaNJ8X0rZk= github.com/coder/retry v1.5.1 h1:iWu8YnD8YqHs3XwqrqsjoBTAVqT9ml6z9ViJ2wlMiqc= github.com/coder/retry v1.5.1/go.mod h1:blHMk9vs6LkoRT9ZHyuZo360cufXEhrxqvEzeMtRGoY= -github.com/coder/serpent v0.13.0 h1:6EoWjpEypkb8cS6i0eCF4qoAv9vrEVaX26RW+3FMMvo= -github.com/coder/serpent v0.13.0/go.mod h1:7OIvFBYMd+OqarMy5einBl8AtRr8LliopVU7pyrwucY= +github.com/coder/serpent v0.14.0 h1:g7vt2zBMp3nWyAvyhvQduaI53Ku65U3wITMi01+/8pU= +github.com/coder/serpent v0.14.0/go.mod h1:7OIvFBYMd+OqarMy5einBl8AtRr8LliopVU7pyrwucY= github.com/coder/ssh v0.0.0-20231128192721-70855dedb788 h1:YoUSJ19E8AtuUFVYBpXuOD6a/zVP3rcxezNsoDseTUw= github.com/coder/ssh v0.0.0-20231128192721-70855dedb788/go.mod h1:aGQbuCLyhRLMzZF067xc84Lh7JDs1FKwCmF1Crl9dxQ= github.com/coder/tailscale v1.1.1-0.20250829055706-6eafe0f9199e h1:9RKGKzGLHtTvVBQublzDGtCtal3cXP13diCHoAIGPeI= diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts index cee52f7fbc..9b968ce899 100644 --- a/site/src/api/typesGenerated.ts +++ b/site/src/api/typesGenerated.ts @@ -4604,6 +4604,7 @@ export interface SerpentOption { readonly yaml?: string; /** * Default is parsed into Value if set. + * Must be `""` if `DefaultFn` != nil */ readonly default?: string; /**