fix: enforce session auth hostname invariant - #1059
Conversation
There was a problem hiding this comment.
Looks good but how does this fix #1057? Supposedly we are replacing coder.example.com with cursor.example.com but I see nothing in this diff that should affect that, just new assertions.
Unless it is related to the file migration somehow? But it seems like that would imply we somehow mangled the domain to begin with so the root bug must still be around somewhere.
|
The theory here is that this was because of a failed migration but this does not really fix it because there is nothing in our codebase that could do this, I have a suspicion that this is related to global settings not being applied to remote connection which is already fixed on main. Also this would catch the users error much earlier and show more info, so hopefully we can understand how that happened. |
Include the offending URL in the invalid-URL error and log the error itself at both call sites instead of a generic message. The mismatch branch still reports only hostnames, so a stored URL carrying credentials does not reach the log.
2 participants
Summary
Addresses #1057.
Validation
pnpm test— 2,264 passed, 1 skippedpnpm typecheckNODE_OPTIONS=--max-old-space-size=4096 pnpm lintpnpm format:checkImplementation plan
SecretsManager.This pull request was generated by Coder Agents.