mirror of
https://github.com/coder/code-server.git
synced 2026-09-02 08:30:17 +02:00
208c81a072
We use the cookie parser to remove the code-server token but by default it encodes using encodeURIComponent, which encodes more than is strictly necessary and can break proxied applications. Now we pass the cookies through unchanged (other than removing the code-server token). Fixes #7927.
57 lines
2.0 KiB
TypeScript
57 lines
2.0 KiB
TypeScript
import * as cookie from "cookie"
|
|
import type { Request } from "express"
|
|
import proxyServer from "http-proxy"
|
|
import { getCookieSessionName, HttpCode } from "../common/http"
|
|
|
|
export const proxy = proxyServer.createProxyServer({})
|
|
|
|
// The error handler catches when the proxy fails to connect (for example when
|
|
// there is nothing running on the target port).
|
|
proxy.on("error", (error, _, res) => {
|
|
// This could be for either a web socket or a regular request. Despite what
|
|
// the types say, writeHead() will not exist on web socket requests (nor will
|
|
// status() from Express). But writing out the code manually does not work
|
|
// for regular requests thus the branching behavior.
|
|
if (typeof res.writeHead !== "undefined") {
|
|
res.writeHead(HttpCode.ServerError)
|
|
res.end(error.message)
|
|
} else {
|
|
res.end(`HTTP/1.1 ${HttpCode.ServerError} ${error.message}\r\n\r\n`)
|
|
}
|
|
})
|
|
|
|
function identity<T>(val: T): T {
|
|
return val
|
|
}
|
|
|
|
// Strip the code-server cookie if it exists to avoid transmitting the cookie
|
|
// to potentially malicious local ports.
|
|
proxy.on("proxyReq", (preq, req) => {
|
|
if (req.headers.cookie) {
|
|
const cookieSessionName = getCookieSessionName((req as Request).args["cookie-suffix"])
|
|
// Encoding and decoding are no-ops; we just want to remove the token
|
|
// without changing anything else about the cookies because not all
|
|
// applications encode/decode the same way `cookie` here does.
|
|
preq.setHeader(
|
|
"Cookie",
|
|
cookie.stringifyCookie(
|
|
{
|
|
...cookie.parseCookie(req.headers.cookie, { decode: identity }),
|
|
[cookieSessionName]: undefined,
|
|
},
|
|
{
|
|
encode: identity,
|
|
},
|
|
),
|
|
)
|
|
}
|
|
})
|
|
|
|
// Intercept the response to rewrite absolute redirects against the base path.
|
|
// Is disabled when the request has no base path which means /absproxy is in use.
|
|
proxy.on("proxyRes", (res, req) => {
|
|
if (res.headers.location && res.headers.location.startsWith("/") && (req as any).base) {
|
|
res.headers.location = (req as any).base + res.headers.location
|
|
}
|
|
})
|