fix(devtools): continue hardening the RPC surface - #1049
Merged
Conversation
Follow-up to the dev auth token work, covering the rest of the RPC surface reachable over the HMR WebSocket: - structured-clone-es: require >=2.0.1 (catalog + tree-wide override) so the deserializer allowlists constructors, and add onGeneralError on the server channel so a frame it now rejects is dropped instead of crashing dev. - enableTimeline, customTabAction, getServerRuntimeConfig: require the dev auth token (config write + restart, custom-tab action handler, and runtimeConfig/env exposure respectively). - getServerConfig: strip private runtimeConfig from this unauthenticated, eagerly-read payload (keeps public/app). - requestForAuth: always derive the origin server-side rather than trusting a client-supplied one. - RPC channel: only accept same-origin WebSocket connections, leaving the HMR socket itself untouched.
Deploying nuxt-devtools with
|
| Latest commit: |
4e3962f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://0de16c48.nuxt-devtools.pages.dev |
| Branch Preview URL: | https://fix-devtools-rpc-hardening.nuxt-devtools.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #1039. That PR added the dev auth token to
openInEditor,updateOptionsandclearOptions; this one brings the rest of the RPC surface (all reachable over the Vite HMR WebSocket) in line with the same model, and hardens the transport itself.Changes
Serialization
structured-clone-es>=2.0.1via the catalog and a tree-wideresolutionsoverride, so every copy in the dev-server process (including transitive ones) uses the version whose deserializer allowlists the constructors it will instantiate.onGeneralErrorto the server RPC channel so a frame that fails to deserialize is dropped rather than surfacing as an unhandled rejection.Consistent token checks (mirroring
restartNuxt, storage writes, etc.)enableTimeline— now requires the token before rewritingnuxt.configand restarting.customTabAction— now requires the token before invoking a custom tab's launch action handler.getServerRuntimeConfig— now requires the token; it exposesruntimeConfigmerged with env vars.Reduced unauthenticated exposure
getServerConfig— strips privateruntimeConfigfrom this eagerly-read, unauthenticated payload (keepspublic/app).requestForAuth— always derives the origin server-side instead of trusting a client-supplied value.Transport
Notes
ensureDevAuthToken()flow; behaviour for already-authenticated sessions is unchanged.lint,vue-tsctypecheck, unit tests, and the full build all pass.This PR was created with the help of an agent.