Repository navigation
Conversation
toSafeHost returns an origin label (host for HTTPS on 443, else host_<scheme><port>), so sessions, OAuth client registrations, CLI config directories, SSH hosts, and the binary cache are per origin. - Ignore entries an older version stored under the bare hostname for another origin; re-derive the saved deployment's label from its URL. - Refuse another origin in the sign-in dialog before signing in. - Keep getSessionAuth for label-only callers; the rest look up by URL.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every per-deployment store was keyed by hostname, so two deployments on one host with a different scheme or port shared sessions, OAuth client registrations, CLI config directories, SSH hosts, and the CLI binary cache. Signing in or out of one overwrote the other, and a window could connect to the wrong deployment. This builds on #1173, which made the origin the deployment's identity.
toSafeHost(url)now returns an origin label that every store already keys on:https://host,https://host:443host(unchanged)https://host:8443host_8443http://host,http://host:80host_httphttp://host:8080host_http8080https://my_hostmy_host_httpsExplicit default ports are dropped by URL parsing. Hostnames containing
_always get a suffix, so the text after the last_is always the suffix, and its grammar (https,http[port],port) is unambiguous. A test checks every pair across schemes, ports, and look-alike hostnames: two URLs share a label exactly when they share an origin. Window addresses parse as before. The sign-in dialog refuses a URL for another origin, andgetSessionAuthstays only for label-only callers.Migration: HTTPS on port 443 is unchanged. Other origins sign in once more and download the CLI again. Old recent workspaces and links for them now point at the HTTPS origin; reopen them from the Coder sidebar.