Account for hosts with/without ports in origin check
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- typescript
- Domain
- security
Research direction
Start by reproducing the origin and host comparison with the provided NGINX proxy_set_header configuration, then review related issues 6161, 6023, 6064, and 6014. Determine the intended handling of default and non-default ports; done means the websocket origin check consistently accepts valid matching configurations without weakening its security guarantees.
Written by the indexing model from the issue text.
Description
Is there an existing issue for this?
- I have searched the existing issues
OS/Web Information
N/A
Steps to Reproduce
You can simulate with this NGINX config:
proxy_set_header X-Forwarded-Host $host:$server_port;
Expected
If your origin is https://domain.tld and your host is domain.tld:443 the check should pass. Same for http://domain.tld and domain.tld:80.
Also I think NGINX's $host actually does not include ports so it will fail if your config only has $host and if you host on a port other than 443 and 80 since you would get an origin like https://domain.tld:8080 and the host would be domain.tld.
To fix the first we could just check the protocol on the origin and then add/remove 443 or 80.
For the second we could ignore the port altogether since I think the vulnerability does not happen across ports...
But I am not sure we should do anything; maybe the correct course of action is to edit the proxy config so the host and origin headers match. I have looked at other software but they all seem to do exact matches without messing around with the port. We could just edit the documentation to use $http_host.
Actual
The origin and domain are matched exactly so they do not match. Ends up causing the web sockets to fail with 1006.
Logs
No response
Screenshot/Video
No response
Does this issue happen in VS Code or GitHub Codespaces?
- I cannot reproduce this in VS Code.
- I cannot reproduce this in GitHub Codespaces.
Are you accessing code-server over HTTPS?
- I am using HTTPS.
Notes
https://github.com/coder/code-server/issues/6161
Might be causing issues reported in https://github.com/coder/code-server/issues/6023 and https://github.com/coder/code-server/issues/6064 as well.
And possibly https://github.com/coder/code-server/issues/6014
- Dominant language
- TypeScript
- Stars
- 79.4k
- Forks
- 6.9k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 39
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from coder/code-server
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
coder/code-server#8017 · 2 comments ·
-
security
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
coder/code-server#8013 · 4 comments ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
coder/code-server#7976 · 2 comments ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
coder/code-server#7962 · 3 comments ·
-
bug needs-investigation
Difficulty 4/5 3-5 days Newbie friendliness 55/100
coder/code-server#7955 · 1 comment ·
All issues in coder/code-server
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
vercel-labs/just-bash#464 ·
-
looksLikeSlug() is ASCII-only, so non-Latin entity slugs (e.g. Korean) skip exact match and collapse Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
TanStack/tanstack.com#1293 ·