[server] strict same site origin for /api/gitpod endpoint #16378
Conversation
|
started the job as gitpod-build-ak-strict-server.1 because the annotations in the pull request description changed |
|
/werft run 👍 started the job as gitpod-build-ak-strict-server.2 |
jeanp413
force-pushed
the
ak/strict_server
branch
from
2b69cad to
b1bfaef
Compare
jeanp413
force-pushed
the
ak/strict_server
branch
from
b1bfaef to
7f6514c
Compare
|
/hold |
jeanp413
force-pushed
the
ak/strict_server
branch
from
7f6514c to
a92d759
Compare
|
@geropl, just FYI, I did a quick test and this kind of change does provide an effective blocking. |
geropl
force-pushed
the
ak/strict_server
branch
from
a92d759 to
a17c736
Compare
| // Only exception: If no Origin header is set, skip the check! | ||
| export const isAllowedWebsocketDomain = (originHeader: string, gitpodHostName: string, strict: boolean): boolean => { | ||
| if (!originHeader) { | ||
| // TODO(gpl) Can we get rid of this dependency alltogether? |
There was a problem hiding this comment.
Not sure how to read that comment. Could you clarify?
Is it planned to disallow creation of the WebSocket connection from clients other than browser agents?
If not, this check remains less meaningful outside of browser, i.e. from other clients it would be possible to set origin to any value. This is the reason to skip here and provide a signal, that this is browser-only security mechanism.
There was a problem hiding this comment.
Is it planned to disallow creation of the WebSocket connection from clients other than browser agents?
Yes, at least for session/cookie authentiction. BearerAuth could keep working with the check !originHeader && !strict.
I basically want to have more insight into how this branch is used. 👍
|
@akosyakov @AlexTugarev Could somebody help with testing local IDEs? I get "SSH test connection error: ip:22 connection refused" |
cc @iQQBot maybe you can help? |
geropl
force-pushed
the
ak/strict_server
branch
from
a17c736 to
4c322c7
Compare
|
Done with testing, just worked after @iQQBot fixed the ingress proxy 🙏 |
geropl
left a comment
geropl
left a comment
There was a problem hiding this comment.
Thanks @akosyakov , ended up taking over most of your code with one change and some more comments/logs. 🙏
Tested and LGTM ✔️
|
/unhold |
roboquat
added
deployed: webapp
Description
Strict same site origin for /api/gitpod endpoint
How to test
new WebSocket("wss://ak-strict-server.preview.gitpod-dev.com/api/gitpod")Release Notes
Documentation
Build Options:
Experimental feature to run the build with GitHub Actions (and not in Werft).
leeway-target=components:all
Run Leeway with
--dont-testPublish Options
Installer Options
Add desired feature flags to the end of the line above, space separated
Preview Environment Options:
If enabled this will build
install/previewIf enabled this will create the environment on GCE infra
Valid options are
all,workspace,webapp,ide,jetbrains,vscode,ssh