🐛 Fix Go test failures: validateToken query params + checkOrigin deep subdomains by clubanderson · Pull Request #4099 · kubestellar/console

clubanderson · 2026-04-01T11:39:02Z

Summary

Fixes two Go test failures that have been failing the Release workflow for 3+ days (#4077):

TestServer_ValidateToken/Valid_query_parameter_token — validateToken() only checked the Authorization header. Added query parameter ?token= fallback for WebSocket connections that can't set custom headers. Bearer header is still preferred.
TestServer_CheckOrigin/Deep_subdomain_match — matchOrigin() restricted wildcards to single-level subdomains (!strings.Contains(middle, ".")). Now allows any subdomain depth so https://*.ibm.com matches https://kc.apps.example.ibm.com.

Both tests now pass locally: go test ./pkg/agent/ -run "TestServer_ValidateToken|TestServer_CheckOrigin" -v

Test plan

TestServer_ValidateToken — all 7 subtests pass
TestServer_CheckOrigin — all 8 subtests pass (including deep subdomain)

Two fixes for tests failing in the Release workflow for 3+ days: 1. validateToken: Add query parameter token support as fallback for WebSocket connections that can't set Authorization headers. Bearer header is still checked first. 2. checkOrigin: Allow deep subdomain matching for wildcard origins. "https://*.ibm.com" now matches "https://kc.apps.example.ibm.com" (was restricted to single-level subdomains only). Fixes #4077 (Release workflow failure) Signed-off-by: Andrew Anderson <andy@clubanderson.com>

kubestellar-prow · 2026-04-01T11:39:07Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mikespreitzer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

netlify · 2026-04-01T11:39:08Z

✅ Deploy Preview for kubestellarconsole canceled.

Name	Link
🔨 Latest commit	`aa72e5d`
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/69cd03d9ee9608000865e320

github-actions · 2026-04-01T11:39:11Z

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

Claude Code (Opus 4.5 / 4.6) — recommended

GitHub Copilot

Cursor

Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

github-actions · 2026-04-01T11:39:13Z

Thank you for your contribution! Your PR has been merged.

Check out what's new:

KubeStellar Console — Live multi-cluster dashboard
Marketplace — Community extensions
Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

Copilot

Pull request overview

Fixes failing Go tests in the agent server by expanding authentication and origin-matching behavior to cover additional real-world connection scenarios (query-token WebSocket auth and deep subdomain wildcard matching).

Changes:

Update validateToken() to prefer Authorization: Bearer and add a ?token= query fallback.
Update wildcard origin matching so https://*.domain patterns match deep subdomains (not just single-level).
Adjust inline comments around the updated matching/token logic.

Copilot · 2026-04-01T11:42:50Z

pkg/agent/server.go

+	// Fall back to query parameter (for WebSocket connections that can't set headers)
+	if queryToken := r.URL.Query().Get("token"); queryToken != "" {
+		return queryToken == s.agentToken
+	}


validateToken now accepts ?token= for all HTTP endpoints that call this helper, not just the WebSocket upgrade. This reintroduces the exact risk called out in the function header comment (#3895): secrets can end up in browser history, referrers, proxy/access logs, and telemetry. Consider restricting the query-param fallback to the WebSocket handshake only (e.g., r.URL.Path == "/ws" and/or Upgrade: websocket), or adding an explicit opt-in for query-token auth; keep header-based auth as the only option for normal HTTP endpoints.

Copilot · 2026-04-01T11:42:51Z

pkg/agent/server.go

 		return true
 	}

-	// Accept token exclusively from the Authorization header
+	// Check Authorization header first
 	authHeader := r.Header.Get("Authorization")
 	if strings.HasPrefix(authHeader, "Bearer ") {


The doc comment above validateToken still says tokens are accepted ONLY via the Authorization header, but the implementation now also accepts ?token=. Please update that comment to match the new behavior and clarify any intended constraints (e.g., if query-token support is meant to be WebSocket-only).

Copilot · 2026-04-01T11:42:51Z

pkg/agent/server.go

 // For wildcard patterns like "https://*.ibm.com", matches only a single subdomain level
 // (e.g. "https://kc.ibm.com" matches but "https://evil.kc.ibm.com" does not).


matchOrigin’s header comment still describes wildcard patterns as matching only a single subdomain level, but the logic was changed to allow any subdomain depth. Please update the function-level comment examples so the documented security behavior matches the implementation.

Suggested change

// For wildcard patterns like "https://*.ibm.com", matches only a single subdomain level

// (e.g. "https://kc.ibm.com" matches but "https://evil.kc.ibm.com" does not).

// For wildcard patterns like "https://*.ibm.com", matches any subdomain depth (at least one subdomain level),

// e.g. "https://kc.ibm.com" and "https://evil.kc.ibm.com" both match.

Copilot · 2026-04-01T11:42:51Z

pkg/agent/server.go

 		}
 		// Extract the subdomain part between the scheme and the suffix
 		middle := origin[len(scheme) : len(origin)-len(suffix)]
-		// Must be non-empty and contain no dots (single-level subdomain only)
-		return len(middle) > 0 && !strings.Contains(middle, ".")
+		// Must be non-empty (at least one subdomain level)
+		return len(middle) > 0


With this change, matchOrigin("https://deep.sub.ibm.com", "https://*.ibm.com") now returns true. The existing TestMatchOrigin in pkg/agent/server_test.go currently expects multi-level subdomains to be rejected, so go test ./pkg/agent will fail unless that test case (and any similar assumptions) is updated to match the new intended behavior.

clubanderson · 2026-04-01T11:43:00Z

🔄 Auto-Applying Copilot Code Review

Copilot code review found 1 code suggestion(s) and 3 general comment(s).

@copilot Please apply all of the following code review suggestions:

pkg/agent/server.go (line 622): // For wildcard patterns like "https://*.ibm.com", matches any subdomain depth (...

Also address these general comments:

pkg/agent/server.go (line 276): validateToken now accepts ?token= for all HTTP endpoints that call this helper, not just the WebSocket upgrade. Th
pkg/agent/server.go (line 266): The doc comment above validateToken still says tokens are accepted ONLY via the Authorization header, but the implemen
pkg/agent/server.go (line 635): With this change, matchOrigin("https://deep.sub.ibm.com", "https://*.ibm.com") now returns true. The existing `TestMat

Push all fixes in a single commit. Run cd web && npm run build && npm run lint before committing.

Auto-generated by copilot-review-apply workflow.

- server.go: Restrict query param token to WebSocket upgrades only, update stale comments for validateToken and matchOrigin (#4099) - useMissions.tsx: Guard against double-cancel with timeout map check (#4143) - mcp.go: Nil guard on ListWorkloads result before accessing Items (#4145) - workload.go: Remove redundant len(nodes)>0 guard after early continue (#4146) - workload_scaling_test.go: Rename test to ZeroNodeCluster (not UnreachableCluster) (#4146) Signed-off-by: Andrew Anderson <andy@clubanderson.com>

…4158) - server.go: Restrict query param token to WebSocket upgrades only, update stale comments for validateToken and matchOrigin (#4099) - useMissions.tsx: Guard against double-cancel with timeout map check (#4143) - mcp.go: Nil guard on ListWorkloads result before accessing Items (#4145) - workload.go: Remove redundant len(nodes)>0 guard after early continue (#4146) - workload_scaling_test.go: Rename test to ZeroNodeCluster (not UnreachableCluster) (#4146) Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Copilot AI review requested due to automatic review settings April 1, 2026 11:39

clubanderson merged commit 7d221c9 into main Apr 1, 2026

kubestellar-prow bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Apr 1, 2026

kubestellar-prow bot deleted the fix/go-test-failures branch April 1, 2026 11:39

kubestellar-prow bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Apr 1, 2026

Copilot started reviewing on behalf of clubanderson April 1, 2026 11:39 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

clubanderson assigned Copilot Apr 1, 2026

clubanderson mentioned this pull request Apr 1, 2026

🐛 Address Copilot review comments: token security, double-cancel guard, nil checks #4158

Merged

2 tasks

clubanderson mentioned this pull request Apr 1, 2026

🐛 Address Copilot review comments from 8 merged PRs #4161

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🐛 Fix Go test failures: validateToken query params + checkOrigin deep subdomains#4099

🐛 Fix Go test failures: validateToken query params + checkOrigin deep subdomains#4099
clubanderson merged 1 commit intomainfrom
fix/go-test-failures

clubanderson commented Apr 1, 2026

Uh oh!

kubestellar-prow bot commented Apr 1, 2026

Uh oh!

netlify bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 1, 2026

Uh oh!

github-actions bot commented Apr 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

clubanderson commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// For wildcard patterns like "https://*.ibm.com", matches only a single subdomain level
		// (e.g. "https://kc.ibm.com" matches but "https://evil.kc.ibm.com" does not).

Conversation

clubanderson commented Apr 1, 2026

Summary

Test plan

Uh oh!

kubestellar-prow bot commented Apr 1, 2026

Uh oh!

netlify bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubestellarconsole canceled.

Uh oh!

github-actions bot commented Apr 1, 2026

Uh oh!

github-actions bot commented Apr 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

clubanderson commented Apr 1, 2026

🔄 Auto-Applying Copilot Code Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Apr 1, 2026 •

edited

Loading