Skip to content

Commit 7b2ba10

Browse files
EdwardAngertEdwardAngert
authored
Merge branch 'main' into dev-container-ga
2 parents 6ee9fd4 + ab254ad commit 7b2ba10

File tree

4 files changed

+64
-5
lines changed

4 files changed

+64
-5
lines changed

‎docs/admin/setup/index.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@ If you are providing TLS certificates directly to the Coder server, either
6060
options (these both take a comma separated list of files; list certificates
6161
and their respective keys in the same order).
6262

63+
After you enable the wildcard access URL, you should [disable path-based apps](../../tutorials/best-practices/security-best-practices.md#disable-path-based-apps) for security.
64+
6365
## TLS & Reverse Proxy
6466

6567
The Coder server can directly use TLS certificates with `CODER_TLS_ENABLE` and

‎docs/tutorials/best-practices/security-best-practices.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,33 @@ logs (which have `msg: audit_log`) and retain them for a minimum of two years
6666
If a security incident with Coder does occur, audit logs are invaluable in
6767
determining the nature and scope of the impact.
6868

69+
### Disable path-based apps
70+
71+
For production deployments, we recommend that you disable path-based apps after you've configured a wildcard access URL.
72+
73+
Path-based apps share the same origin as the Coder API, which can be convenient for trialing Coder,
74+
but can expose the deployment to cross-site-scripting (XSS) attacks in production.
75+
A malicious workspace could reuse Coder cookies to call the API or interact with other workspaces owned by the same user.
76+
77+
1. [Enable sub-domain apps with a wildcard DNS record](../../admin/setup/index.md#wildcard-access-url) (like `*.coder.example.com`)
78+
79+
1. Disable path-based apps:
80+
81+
```shell
82+
coderd server --disable-path-apps
83+
# or
84+
export CODER_DISABLE_PATH_APPS=true
85+
```
86+
87+
By default, Coder mitigates the impact of having path-based apps enabled, but we still recommend disabling it to prevent
88+
malicious workspaces accessing other workspaces owned by the same user or performing requests against the Coder API.
89+
90+
If you do keep path-based apps enabled:
91+
92+
- Path-based apps cannot be shared with other users unless you start the Coder server with `--dangerous-allow-path-app-sharing`.
93+
- Users with the site `owner` role cannot use their admin privileges to access path-based apps for workspaces unless the
94+
server is started with `--dangerous-allow-path-app-site-owner-access`.
95+
6996
## PostgreSQL
7097

7198
PostgreSQL is the persistent datastore underlying the entire Coder deployment.

‎site/src/pages/CreateTemplateGalleryPage/CreateTemplateGalleryPageView.tsx

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,12 @@ import CardActionArea from "@mui/material/CardActionArea";
44
import CardContent from "@mui/material/CardContent";
55
import Stack from "@mui/material/Stack";
66
import { ErrorAlert } from "components/Alert/ErrorAlert";
7+
import { Button } from "components/Button/Button";
78
import { ExternalImage } from "components/ExternalImage/ExternalImage";
89
import { Loader } from "components/Loader/Loader";
910
import { Margins } from "components/Margins/Margins";
1011
import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
12+
import { ExternalLinkIcon } from "lucide-react";
1113
import type { FC } from "react";
1214
import { Link as RouterLink } from "react-router-dom";
1315
import type { StarterTemplatesByTag } from "utils/starterTemplates";
@@ -23,7 +25,21 @@ export const CreateTemplateGalleryPageView: FC<
2325
> = ({ starterTemplatesByTag, error }) => {
2426
return (
2527
<Margins>
26-
<PageHeader>
28+
<PageHeader
29+
actions={
30+
<Button asChild size="sm" variant="outline">
31+
<a
32+
href="https://registry.coder.com"
33+
target="_blank"
34+
rel="noopener noreferrer"
35+
className="flex items-center"
36+
>
37+
Browse the Coder Registry
38+
<ExternalLinkIcon className="size-icon-sm ml-1" />
39+
</a>
40+
</Button>
41+
}
42+
>
2743
<PageHeaderTitle>Create a Template</PageHeaderTitle>
2844
</PageHeader>
2945
<Stack spacing={8}>

‎site/src/pages/TemplateVersionEditorPage/TemplateVersionEditor.tsx

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
import { type Interpolation, type Theme, useTheme } from "@emotion/react";
2-
import Button from "@mui/material/Button";
32
import IconButton from "@mui/material/IconButton";
43
import Tooltip from "@mui/material/Tooltip";
54
import { getErrorDetail, getErrorMessage } from "api/errors";
@@ -12,6 +11,7 @@ import type {
1211
WorkspaceResource,
1312
} from "api/typesGenerated";
1413
import { Alert } from "components/Alert/Alert";
14+
import { Button } from "components/Button/Button";
1515
import { Sidebar } from "components/FullPageLayout/Sidebar";
1616
import {
1717
Topbar,
@@ -25,7 +25,7 @@ import { displayError } from "components/GlobalSnackbar/utils";
2525
import { Loader } from "components/Loader/Loader";
2626
import { TriangleAlertIcon } from "lucide-react";
2727
import { ChevronLeftIcon } from "lucide-react";
28-
import { PlayIcon, PlusIcon, XIcon } from "lucide-react";
28+
import { ExternalLinkIcon, PlayIcon, PlusIcon, XIcon } from "lucide-react";
2929
import { linkToTemplate, useLinks } from "modules/navigation";
3030
import { ProvisionerAlert } from "modules/provisioners/ProvisionerAlert";
3131
import { AlertVariant } from "modules/provisioners/ProvisionerAlert";
@@ -255,6 +255,20 @@ export const TemplateVersionEditor: FC<TemplateVersionEditorProps> = ({
255255
paddingRight: 16,
256256
}}
257257
>
258+
<span className="mr-2">
259+
<Button asChild size="sm" variant="outline">
260+
<a
261+
href="https://registry.coder.com"
262+
target="_blank"
263+
rel="noopener noreferrer"
264+
className="flex items-center"
265+
>
266+
Browse the Coder Registry
267+
<ExternalLinkIcon className="size-icon-sm ml-1" />
268+
</a>
269+
</Button>
270+
</span>
271+
258272
<TemplateVersionStatusBadge version={templateVersion} />
259273

260274
<div className="flex gap-1 items-center">
@@ -312,8 +326,8 @@ export const TemplateVersionEditor: FC<TemplateVersionEditorProps> = ({
312326
dismissible
313327
actions={
314328
<Button
315-
variant="text"
316-
size="small"
329+
variant="subtle"
330+
size="sm"
317331
onClick={onCreateWorkspace}
318332
>
319333
Create a workspace

0 commit comments

Comments
 (0)