Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't check httponly cookie in dashboard #15666

Open
mustard-mh opened this issue Jan 10, 2023 · 3 comments
Open

Don't check httponly cookie in dashboard #15666

mustard-mh opened this issue Jan 10, 2023 · 3 comments
Labels
component: dashboard meta: never-stale This issue can never become stale team: webapp Issue belongs to the WebApp team

Comments

@mustard-mh
Copy link
Contributor

mustard-mh commented Jan 10, 2023

We check and auth workspace cookie in workspace origin, but that cookie is httpOnly, which means this if will not work

Code pointer

if (!document.cookie.includes(`${instanceID}_owner_`)) {

Cookie policy Six requests from StartWorkspace.tsx
image image

How to reproduce

  • Open workspace https://gitpod.new with browser code
  • Exec curl lama.sh | sh to listen to port
  • Go to Ports tab next to Terminal tab in browser
  • Switch port private/public state and check with Browser DevTools / Network or Console
@mustard-mh mustard-mh added the meta: never-stale This issue can never become stale label Jan 10, 2023
@mustard-mh
Copy link
Contributor Author

ensureWorkspaceAuth will be called when instance updates, but if check is not working, so once instance updates, we will request workspace auth. confirmed in production environment
image

@jeanp413 jeanp413 added the team: webapp Issue belongs to the WebApp team label Jan 17, 2023
@AlexTugarev
Copy link
Member

@geropl is this issue still relevant? I recall you were working on this recently.

@geropl
Copy link
Member

geropl commented Mar 15, 2023

is this issue still relevant? I recall you were working on this recently.

I think it is relevant, as I did not touch this part of the code, but just took it for granted. If it really does not work, this would be an optimization. Not sure how important it is, though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component: dashboard meta: never-stale This issue can never become stale team: webapp Issue belongs to the WebApp team
Projects
Status: No status
Development

No branches or pull requests

4 participants