The HTTP client created by `auth.NewClient` has an idle timeout of
30s and each instance periodically gets cert authorities in
`TeleportProcess.syncRotationStateCycle`. If there has been no
activity when the ticker expires then the request will result in a
brand new connection to Auth to be established. This can cause a
spikes in open file descriptors on the Proxy when there are a large
number of instances connected via a tunnel.
To prevent periodic dialing when retrieving cert authorities the
endpoint has been migrated to the new Trust gRPC service. For now
only the get endpoint has been migrated but the rest of the CRUD
operations for cert authorities should be migrated from the HTTP
api to the gRPC service as well.
* Change the application access auth flow to use a CORS POST request
* Remove auth state cookie
* Close the response body in tests
* Change the CSP to allow cross origin requests to the application
* Change the cookies to lax mode
* Update lib/web/app/handler_test.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Fix the proxy URL in tests
* Update webassets ref
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* pass and preserve a path parameter during the app access authentication process
* added missing semicolons
* more javascript formatting
* removed incorrect path redirect. replace URL with URL.Path
* added a test for HasName
* added another test for default path
* ensure path param is valid path
* build url without string concat
* feat(reversetunnel): add a dial counter on fake remote site
* refactor(app): change `MatchHealthy` to close connections
* refactor(app): change `MatchAll` order to not dial all servers
* refactor(app): only close connection when dial succeeds
rosstimothy