Thomas Kosiewski ea37f1ff86 feat: pass session token as query param on agent chat WebSockets (#23405) ...

## Problem

When the Coder chat UI is embedded in a VS Code webview, the session
token is set via the Coder-Session-Token header for HTTP requests.
However, browsers cannot attach custom headers to WebSocket connections,
and VS Code Electron webview environment does not support cookies set
via Set-Cookie from iframe origins. This causes all chat WebSocket
connections to fail with authorization errors.

## Solution

Pass the session token as a coder_session_token query parameter on all
chat-related WebSocket connections. The backend already accepts this
parameter (see APITokenFromRequest in coderd/httpmw/apikey.go).

The token is only included when API.getSessionToken() returns a value,
which only happens in the embed bootstrap flow. Normal browser sessions
use cookies and are unaffected.

> Built with [Coder Agents](https://coder.com/agents)

2026-03-23 15:27:55 +01:00

..

docs.go

feat: pass session token as query param on agent chat WebSockets (#23405)

2026-03-23 15:27:55 +01:00

swagger.json

feat: pass session token as query param on agent chat WebSockets (#23405)

2026-03-23 15:27:55 +01:00