githubmirror/code-server

src/node/proxy.ts
56 строк2 KB
Asher
Fix mistakenly encoding cookies to proxy
07 авг 2026, 00:06
07 авг 2026, 00:06208c81a
import * as cookie from "cookie"
import type { Request } from "express"
import proxyServer from "http-proxy"
import { getCookieSessionName, HttpCode } from "../common/http"

export const proxy = proxyServer.createProxyServer({})

// The error handler catches when the proxy fails to connect (for example when
// there is nothing running on the target port).
proxy.on("error", (error, _, res) => {
  // This could be for either a web socket or a regular request.  Despite what
  // the types say, writeHead() will not exist on web socket requests (nor will
  // status() from Express).  But writing out the code manually does not work
  // for regular requests thus the branching behavior.
  if (typeof res.writeHead !== "undefined") {
    res.writeHead(HttpCode.ServerError)
    res.end(error.message)
  } else {
    res.end(`HTTP/1.1 ${HttpCode.ServerError} ${error.message}\r\n\r\n`)
  }
})

function identity<T>(val: T): T {
  return val
}

// Strip the code-server cookie if it exists to avoid transmitting the cookie
// to potentially malicious local ports.
proxy.on("proxyReq", (preq, req) => {
  if (req.headers.cookie) {
    const cookieSessionName = getCookieSessionName((req as Request).args["cookie-suffix"])
    // Encoding and decoding are no-ops; we just want to remove the token
    // without changing anything else about the cookies because not all
    // applications encode/decode the same way `cookie` here does.
    preq.setHeader(
      "Cookie",
      cookie.stringifyCookie(
        {
          ...cookie.parseCookie(req.headers.cookie, { decode: identity }),
          [cookieSessionName]: undefined,
        },
        {
          encode: identity,
        },
      ),
    )
  }
})

// Intercept the response to rewrite absolute redirects against the base path.
// Is disabled when the request has no base path which means /absproxy is in use.
proxy.on("proxyRes", (res, req) => {
  if (res.headers.location && res.headers.location.startsWith("/") && (req as any).base) {
    res.headers.location = (req as any).base + res.headers.location
  }
})