mirror of
https://github.com/coder/coder.git
synced 2026-10-28 02:42:54 +08:00
Susana Ferreira
47b3846bca
## Description Introduces a new `X-Coder-Token` header for authenticating requests from AI Proxy to AI Bridge. Previously, the proxy overwrote the `Authorization` header with the Coder token, which prevented the original authentication headers from flowing through to upstream providers. With this change, AI Proxy sets the Coder token in a separate header, preserving the original `Authorization` and `X-Api-Key` headers. AI Bridge uses this header for authentication and removes it before forwarding requests to upstream providers. For requests that don't come through AI Proxy, AI Bridge continues to use `Authorization` and `X-Api-Key` for authentication. ## Changes * Add `HeaderCoderAuth` constant and update `ExtractAuthToken` to check headers in the following order: `X-Coder-Token` > `Authorization` > `X-Api-Key` * Update AI Proxy to set `X-Coder-Token` instead of overwriting `Authorization` * Remove `X-Coder-Token` in AI Bridge before forwarding to upstream providers * Add tests for header handling and token extraction priority Related to: https://github.com/coder/internal/issues/1235
AI Bridge Proxy
A MITM (Man-in-the-Middle) proxy server for intercepting and decrypting HTTPS requests to AI providers.
Overview
The AI Bridge Proxy intercepts HTTPS traffic, decrypts it using a configured CA certificate, and forwards requests to AI Bridge for processing.
Configuration
Certificate Setup
Generate a CA key pair for MITM:
1. Generate a new private key
openssl genrsa -out mitm.key 2048
chmod 400 mitm.key
2. Create a self-signed CA certificate
openssl req -new -x509 -days 365 \
-key mitm.key \
-out mitm.crt \
-subj "/CN=Coder AI Bridge Proxy CA"
Configuration options
| Environment Variable | Description | Default |
|---|---|---|
CODER_AIBRIDGE_PROXY_ENABLED |
Enable the AI Bridge Proxy | false |
CODER_AIBRIDGE_PROXY_LISTEN_ADDR |
Address the proxy listens on | :8888 |
CODER_AIBRIDGE_PROXY_CERT_FILE |
Path to the CA certificate file | - |
CODER_AIBRIDGE_PROXY_KEY_FILE |
Path to the CA private key file | - |
Client Configuration
Clients must trust the proxy's CA certificate and authenticate with their Coder session token.
CA Certificate
Clients need to trust the MITM CA certificate:
# Node.js
export NODE_EXTRA_CA_CERTS="/path/to/mitm.crt"
# Python (requests, httpx)
export REQUESTS_CA_BUNDLE="/path/to/mitm.crt"
export SSL_CERT_FILE="/path/to/mitm.crt"
# Go
export SSL_CERT_FILE="/path/to/mitm.crt"
Proxy Authentication
Clients authenticate with the proxy using their Coder session token in the Proxy-Authorization header via HTTP Basic Auth.
The token is passed as the password (username is ignored):
export HTTP_PROXY="http://ignored:<coder-session-token>@<proxy-host>:<proxy-port>"
export HTTPS_PROXY="http://ignored:<coder-session-token>@<proxy-host>:<proxy-port>"
For example:
export HTTP_PROXY="http://coder:${CODER_SESSION_TOKEN}@localhost:8888"
export HTTPS_PROXY="http://coder:${CODER_SESSION_TOKEN}@localhost:8888"
Most HTTP clients and AI SDKs will automatically use these environment variables.