George K and Bobby Ho
8cc7f2bb0e
fix(coderd): reject workspace proxy hostname prefixes ( #27544 )
...
A workspace proxy hostname prefix could be accepted as a valid proxy
access URL. An authenticated user could then be redirected to an
attacker-controlled domain with an application-connect API key in the
URL.
Require proxy access URL matches to have a hostname boundary after the
candidate hostname, allowing only the end of the URL, a port, or a
path.
Add regression coverage for proxy access URL and wildcard hostname
prefixes.
Refs: https://linear.app/codercom/issue/PLAT-384
---------
Co-authored-by: Bobby Ho <bobbidinho@gmail.com >
2026-07-28 13:20:59 -07:00
Cian Johnston
abafc0863c
feat(coderd): store workspace proxy version in the database ( #10790 )
...
Stores workspace proxy version in database upon registration.
2023-11-21 11:21:25 +00:00
Dean Sheather
cd1e088f7c
feat: add --derp-only flag to wsproxy ( #8850 )
2023-08-03 00:35:06 +10:00
Dean Sheather
2f0a9996e7
chore: add derpserver to wsproxy, add proxies to derpmap ( #7311 )
2023-07-27 02:21:04 +10:00
Steven Masley
b5ad628460
chore: Allow editing proxy fields via api. ( #7435 )
...
* chore: Add ability to update workspace proxy fields
2023-05-09 13:46:50 -05:00
Steven Masley
4353ad7940
chore: Remove url and wildcard url from moon create ( #7224 )
...
* chore: Remove url and wildcard url from moon create
2023-04-20 21:09:14 -05:00
Dean Sheather
68667323f3
chore: support signed token query param for web terminal ( #7197 )
...
* chore: add endpoint to get token for web terminal
* chore: support signed token query param for web terminal
2023-04-20 23:59:45 +00:00
Steven Masley
a5a5c4d400
chore: Add workspace proxy enterprise cli commands ( #7176 )
...
* feat: Add workspace proxy enterprise cli commands
* chore: Handle custom workspace proxy options. Remove excess
* chore: Add endpoint to register workspace proxies
2023-04-20 09:48:47 -05:00
Steven Masley and Dean Sheather
658246d5f2
chore: add workspace proxies to the backend ( #7032 )
...
Co-authored-by: Dean Sheather <dean@deansheather.com >
2023-04-17 19:57:21 +00:00
Steven Masley
b4afbe7720
feat: Implement experiment gated CRUD for workspace proxies ( #6928 )
...
* feat: Implement basic moon crud
* chore: Implement enterprise endpoints for moons
2023-04-04 15:07:29 -05:00
