8000 fix: stop redirecting away from wildcard url (#6113) · coder/coder@1617268 · GitHub
[go: up one dir, main page]
Skip to content

Commit 1617268

Browse files
kylecarbskylecarbs
authored
fix: stop redirecting away from wildcard url (#6113)
Fixes #6097.
1 parent 8dba66c commit 1617268

File tree

2 files changed

+30
-13
lines changed

2 files changed

+30
-13
lines changed

‎cli/server.go

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -723,7 +723,7 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
723723
// the request is not to a local IP.
724724
var handler http.Handler = coderAPI.RootHandler
725725
if cfg.RedirectToAccessURL.Value {
726-
handler = redirectToAccessURL(handler, accessURLParsed, tunnel != nil)
726+
handler = redirectToAccessURL(handler, accessURLParsed, tunnel != nil, appHostnameRegex)
727727
}
728728

729729
// ReadHeaderTimeout is purposefully not enabled. It caused some
@@ -1470,7 +1470,7 @@ func configureHTTPClient(ctx context.Context, clientCertFile, clientKeyFile stri
14701470
}
14711471

14721472
// nolint:revive
1473-
func redirectToAccessURL(handler http.Handler, accessURL *url.URL, tunnel bool) http.Handler {
1473+
func redirectToAccessURL(handler http.Handler, accessURL *url.URL, tunnel bool, appHostnameRegex *regexp.Regexp) http.Handler {
14741474
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
14751475
redirect := func() {
14761476
http.Redirect(w, r, accessURL.String(), http.StatusTemporaryRedirect)
@@ -1484,12 +1484,17 @@ func redirectToAccessURL(handler http.Handler, accessURL *url.URL, tunnel bool)
14841484
return
14851485
}
14861486

1487-
if r.Host != accessURL.Host {
1488-
redirect()
1487+
if r.Host == accessURL.Host {
1488+
handler.ServeHTTP(w, r)
1489+
return
1490+
}
1491+
1492+
if appHostnameRegex != nil && appHostnameRegex.MatchString(r.Host) {
1493+
handler.ServeHTTP(w, r)
14891494
return
14901495
}
14911496

1492-
handler.ServeHTTP(w, r)
1497+
redirect()
14931498
})
14941499
}
14951500

‎cli/server_test.go

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232

3333
"github.com/coder/coder/cli/clitest"
3434
"github.com/coder/coder/cli/config"
35+
"github.com/coder/coder/coderd/coderdtest"
3536
"github.com/coder/coder/coderd/database/postgres"
3637
"github.com/coder/coder/coderd/telemetry"
3738
"github.com/coder/coder/codersdk"
@@ -70,11 +71,7 @@ func TestServer(t *testing.T) {
7071
accessURL := waitAccessURL(t, cfg)
7172
client := codersdk.New(accessURL)
7273

73-
_, err = client.CreateFirstUser(ctx, codersdk.CreateFirstUserRequest{
74-
Email: "some@one.com",
75-
Username: "example",
76-
Password: "password",
77-
})
74+
_, err = client.CreateFirstUser(ctx, coderdtest.FirstUserParams)
7875
require.NoError(t, err)
7976
cancelFunc()
8077
require.NoError(t, <-errC)
@@ -540,6 +537,7 @@ func TestServer(t *testing.T) {
540537
tlsListener bool
541538
redirect bool
542539
accessURL string
540+
requestURL string
543541
// Empty string means no redirect.
544542
expectRedirect string
545543
}{
@@ -558,6 +556,14 @@ func TestServer(t *testing.T) {
558556
accessURL: "https://example.com",
559557
expectRedirect: "",
560558
},
559+
{
560+
name: "NoRedirectWithWildcard",
561+
tlsListener: true,
562+
accessURL: "https://example.com",
563+
requestURL: "https://dev.example.com",
564+
expectRedirect: "",
565+
redirect: true,
566+
},
561567
{
562568
name: "NoTLSListener",
563569
httpListener: true,
@@ -583,6 +589,10 @@ func TestServer(t *testing.T) {
583589
ctx, cancelFunc := context.WithCancel(context.Background())
584590
defer cancelFunc()
585591

592+
if c.requestURL == "" {
593+
c.requestURL = c.accessURL
594+
}
595+
586596
httpListenAddr := ""
587597
if c.httpListener {
588598
httpListenAddr = ":0"
@@ -601,6 +611,7 @@ func TestServer(t *testing.T) {
601611
"--tls-address", ":0",
602612
"--tls-cert-file", certPath,
603613
"--tls-key-file", keyPath,
614+
"--wildcard-access-url", "*.example.com",
604615
)
605616
}
606617
if c.accessURL != "" {
@@ -661,7 +672,7 @@ func TestServer(t *testing.T) {
661672

662673
// Verify TLS
663674
if c.tlsListener {
664-
accessURLParsed, err := url.Parse(c.accessURL)
675+
accessURLParsed, err := url.Parse(c.requestURL)
665676
require.NoError(t, err)
666677
client := codersdk.New(accessURLParsed)
667678
client.HTTPClient = &http.Client{
@@ -679,8 +690,9 @@ func TestServer(t *testing.T) {
679690
}
680691
defer client.HTTPClient.CloseIdleConnections()
681692
_, err = client.HasFirstUser(ctx)
682-
require.NoError(t, err)
683-
693+
if err != nil {
694+
require.ErrorContains(t, err, "Invalid application URL")
695+
}
684696
cancelFunc()
685697
require.NoError(t, <-errC)
686698
}

0 commit comments

Comments
 (0)
0