George K 0b99e67ce7 fix(coderd/workspaceapps): verify workspace owner matches app username (#26085) ...

fix(coderd/workspaceapps): verify workspace owner matches app username

When resolving a workspace app by workspace UUID, the URL's username
segment was never reconciled against the resolved workspace's owner.
A user could serve their own workspace app from a hostname embedding
another user's username, so the parsed origin username belonged to the
victim.  Combined with the username-equality CORS check, this allowed
credentialed cross-origin reads of the victim's app responses.

Reject the request with a 404 when the resolved workspace's owner does
not match the user named in the request.

Refs: https://linear.app/codercom/issue/PLAT-260

2026-06-10 16:26:45 -07:00

..

apptest.go

fix(coderd/workspaceapps): verify workspace owner matches app username (#26085)

2026-06-10 16:26:45 -07:00

setup.go

test: use non-monitoring RPC role in apptest setup (#23953)

2026-04-02 20:01:54 +11:00