mirror of
https://github.com/coder/coder.git
synced 2026-09-21 20:51:01 +08:00
Susana Ferreira
a9fb2619e4
## Problem aibridgeproxyd's HTTP transport (`proxy.Tr`) was configured with secure TLS defaults only when an upstream proxy was set. Without one, it fell back to [goproxy's default transport](https://github.com/elazarl/goproxy/blob/v1.8.0/proxy.go#L152), which has `InsecureSkipVerify: true`, leaving the connection between the proxy and aibridge vulnerable to MITM on HTTPS deployments. This PR moves the secure transport assignment outside the upstream proxy branch so it applies unconditionally. ## Changes * Apply secure TLS defaults to `proxy.Tr` unconditionally (verified `RootCAs`, `MinVersion: TLS 1.2`). * Add `TestProxy_AIBridgeTLSVerification` to cover the verification path between the proxy and aibridge. ## Notes * **Behavior change for `HTTPS_PROXY` env var**: previously, when `UpstreamProxy` was unset, `proxy.Tr` honored `HTTP_PROXY` and `HTTPS_PROXY` env vars. After this PR it does not, since MITM'd requests now always go directly to aibridge. This matches the behavior when `UpstreamProxy` is configured, which already ignored env vars. * **HTTPS deployments with a private CA**: when `CoderAccessURL` is HTTPS and its TLS certificate (or the load balancer's certificate fronting it) is signed by a CA not in the system trust store, the proxy will now fail with `x509: certificate signed by unknown authority`. Closes https://linear.app/codercom/issue/AIGOV-386/ai-bridge-proxy-uses-goproxy-default-with-tls-verification-disabled > [!NOTE] > Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira