Skip to content

[1.2] fix(proxy): Require connection token for port proxy requests - #314

Merged
Andrei32Ionescu merged 1 commit into
1.2from
fix/proxy-connection-token-1.2
Oct 16, 2026
Merged

Andrei32Ionescu merged 1 commit into
1.2from
fix/proxy-connection-token-1.2

Conversation

@Andrei32Ionescu

Copy link
Copy Markdown

Description of Changes

Update the proxy server patch (web-server/proxy-uri.diff) so proxied port requests use the same connection token as the workbench.

Changes:

  • When connection token auth is enabled, require a valid connection token for /ports/ and /absports/ requests (HTTP and WebSocket); respond 403 otherwise
  • Servers started with --without-connection-token are unchanged
  • Set HttpOnly and Secure on the vscode-tkn cookie (SameSite=Lax as before); pass the token to the workbench through its configuration
  • Terminate raw-socket proxy responses with \r\n\r\n

Testing

  • Patch applies cleanly via prepare-src.sh for code-editor-server and code-editor-sagemaker-server
  • Built and ran the server with and without connection token auth: workbench, terminal, extensions, webviews and port forwarding (HTTP and WebSocket) work; proxied requests without a valid token return 403

By submitting this pull request, I confirm that you can use, modify, copy,
and redistribute this contribution, under the terms of your choice.

@Andrei32Ionescu
Andrei32Ionescu requested a review from a team as a code owner October 16, 2026 11:29
@Andrei32Ionescu
Andrei32Ionescu added this pull request to the merge queue Oct 16, 2026
Merged via the queue into 1.2 with commit ce4b7f6 Oct 16, 2026
1 check passed
@Andrei32Ionescu
Andrei32Ionescu deleted the fix/proxy-connection-token-1.2 branch October 16, 2026 11:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants