msquee
commented
4 years ago When code-server upgraded to 3.x they removed a command line option to set the base path for URL redirection after login. --base-path was removed from code-server in this commit: https://github.com/cdr/code-server/pull/1272
code-server operates on completely relative paths now, you don't have the option to set a base path anymore.
When code-server is ran as a batch connect application, our URL looks something like this: https://ondemand-test.osc.edu/rnode/o0808.ten.osc.edu/18513/
Relevant Files:
- https://github.com/cdr/code-server/blob/master/src/node/app/proxy.ts
- https://github.com/cdr/code-server/blob/master/src/node/app/login.ts
- https://github.com/cdr/code-server/blob/master/src/node/http.ts#L738
- https://github.com/cdr/code-server/blob/master/src/node/http.ts#L682
- https://github.com/cdr/code-server/blob/master/src/common/util.ts#L33
- https://github.com/cdr/code-server/blob/81411b2af9b088cefb460c719c0abe4bbcefd5d3/src/node/util.ts#L53
- https://github.com/cdr/code-server/blob/master/src/node/app/login.ts#L92
- https://github.com/cdr/code-server/blob/master/src/node/http.ts#L738
Problem:
We require authentication, when we send a POST request to /rnode/o0808.ten.osc.edu/18513/login/ we are redirected to /rnode/o0808.ten.osc.edu/18513/login/rnode/o0808.ten.osc.edu/18513 because code-server doesn't like anything that isn't on the root path. See comment about this from code server developers here: https://github.com/cdr/code-server/pull/1272#issuecomment-573848748
Cause:
When you post to /login/ the redirect logic is done here: https://github.com/cdr/code-server/blob/81411b2af9b088cefb460c719c0abe4bbcefd5d3/src/node/app/login.ts#L87 and we're redirected to route.query.to which comes from /login/?to=${HERE} or if that's not set, we're redirected to / but our base path from /login/ is /rnode/o0808.ten.osc.edu/18513/login/ so we're redirected to /rnode/o0808.ten.osc.edu/18513/login/rnode/o0808.ten.osc.edu/18513/ causing our bug!
Potential Solutions:
-
Modify the Stanford Authentication proxy to support proxying directly to a socket instead of a port https://github.com/stanford-rc/sh_ood-apps/blob/master/sh_tensorboard/template/bin/authrevproxy.py
-
Use @johrstrom's modified
authrevproxywith support for network namespaces https://github.com/OSC/bc_osc_tensorboard/blob/gtc/template/script.sh.erb this would let us startcode-serverwith the option--auth=noneand redirecting from login wouldn't be an issue anymore. The problem with this option is that namespaces are not enabled system wide. -
Create a new sidecar proxy that acts as a middleware that validates a
POSTrequest against the environment variable$PASSWORD, if they match then set a cookie with the keykeyhttps://github.com/cdr/code-server/blob/master/src/node/app/login.ts#L92 so that the user can visit thecode-serverrunning already authenticated.
code-server sets the cookie key value to a hashed SHA256 string here: https://github.com/cdr/code-server/blob/master/src/node/util.ts#L53 from the environment variable here: https://github.com/cdr/code-server/blob/master/src/node/app/login.ts#L82
$PASSWORD so we can just mimick that behavior in a sidecar proxy as long as we have access to the environment variable.
SpontaneousDuck
nathanweeks
johrstrom
vallerul
Upgrade
code-serverto versionv3.4.1(https://github.com/cdr/code-server/releases/tag/v3.4.1)code-serverbc_js_filepickerto0.4.3(https://github.com/OSC/bc_js_filepicker/releases/tag/0.4.3)Known bugs:
code-serversessions running at once may cause the browser to not set cookies properly, refreshing theInteractive Sessionsis the solution for now.Todo:
Further improvement ideas for future releases:
code-serverbinary automatically, create symlink automatically.