Skip to content

fix(proxy): Require connection token for port proxy requests - #313

Merged
Andrei32Ionescu merged 1 commit into
mainfrom
fix/proxy-connection-token-main
Oct 16, 2026
Merged

Andrei32Ionescu merged 1 commit into
mainfrom
fix/proxy-connection-token-main

Conversation

@Andrei32Ionescu

Copy link
Copy Markdown

Description of Changes

Update the proxy server patch (web-server/proxy-uri.diff) so proxied port requests use the same connection token as the workbench.

Changes:

  • When connection token auth is enabled, require a valid connection token for /ports/ and /absports/ requests (HTTP and WebSocket); respond 403 otherwise
  • Servers started with --without-connection-token are unchanged
  • Set HttpOnly and Secure on the vscode-tkn cookie (SameSite=Lax as before); pass the token to the workbench through its configuration
  • Terminate raw-socket proxy responses with \r\n\r\n

Testing

  • Patch applies cleanly via prepare-src.sh for code-editor-server and code-editor-sagemaker-server
  • Built and ran the server with and without connection token auth: workbench, terminal, extensions, webviews and port forwarding (HTTP and WebSocket) work; proxied requests without a valid token return 403

By submitting this pull request, I confirm that you can use, modify, copy,
and redistribute this contribution, under the terms of your choice.

When connection token auth is enabled, the port forwarding proxy requires the connection token for /ports/ and /absports/ (HTTP and WebSocket) and returns 403 otherwise. The vscode-tkn cookie is now HttpOnly and Secure; the server passes the token to the workbench through its configuration. Servers started with --without-connection-token are unchanged.
@Andrei32Ionescu
Andrei32Ionescu requested a review from a team as a code owner October 16, 2026 11:25
@Andrei32Ionescu
Andrei32Ionescu added this pull request to the merge queue Oct 16, 2026
Merged via the queue into main with commit 24dfce9 Oct 16, 2026
3 checks passed
@Andrei32Ionescu
Andrei32Ionescu deleted the fix/proxy-connection-token-main branch October 16, 2026 11:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants