fix(coderd/workspaceapps): verify workspace owner matches app username#26085
Merged
Conversation
07f7dcc to
510ba49
Compare
When resolving a workspace app by workspace UUID, the URL's username segment was never reconciled against the resolved workspace's owner. A user could serve their own workspace app from a hostname embedding another user's username, so the parsed origin username belonged to the victim. Combined with the username-equality CORS check, this allowed credentialed cross-origin reads of the victim's app responses. Reject the request with a 404 when the resolved workspace's owner does not match the user named in the request. Refs: https://linear.app/codercom/issue/PLAT-260
510ba49 to
c773cce
Compare
deansheather
approved these changes
Jun 8, 2026
zedkipp
approved these changes
Jun 8, 2026
They are now the sole line of defense since we decided not to merge #26086 (defense-in-depth)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A workspace app resolved by workspace UUID never reconciled the URL's username segment against the resolved workspace's owner. A user could serve their own workspace app from a hostname embedding another user's username, so the origin username parsed for the CORS check belonged to the victim. Combined with the username-equality CORS check, this allowed credentialed cross-origin reads of the victim's workspace app responses.
This PR is the minimum fix for the vulnerability: reject the request with a 404 when the resolved workspace's owner does not match the user named in the URL. On its own this closes the hole, since an attacker can no longer serve content from a hostname carrying the victim's username.
Refs: https://linear.app/codercom/issue/PLAT-260
This PR is part of a stack that merges into
main:Created with stakk