Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit dfec519

Browse files
code-ashercode-asher
committed
docs: document CORS behavior
1 parent 175561b commit dfec519

File tree

1 file changed

+105
-0
lines changed

1 file changed

+105
-0
lines changed

‎docs/networking/port-forwarding.md

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,3 +94,108 @@ ssh -L 8080:localhost:8000 coder.myworkspace
9494
```
9595

9696
You can read more on SSH port forwarding [here](https://www.ssh.com/academy/ssh/tunneling/example).
97+
98+
## Cross-origin resource sharing (CORS)
99+
100+
Coder automatically sets headers that allow requests between separately
101+
forwarded applications belonging to the same user.
102+
103+
### Authentication
104+
105+
Since forwarded ports are private, cross-origin requests must include
106+
credentials (set `credentials: "include"` if using `fetch`) or the requests
107+
cannot be authenticated and you will see an error resembling the following:
108+
109+
> Access to fetch at 'https://dev.coder.com/api/v2/applications/auth-redirect' from origin 'https://8000--dev--user--apps.dev.coder.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
110+
111+
### Headers
112+
113+
Below is a list of the cross-origin headers Coder sets with example values:
114+
115+
```
116+
access-control-allow-credentials: true
117+
access-control-allow-methods: PUT
118+
access-control-allow-headers: X-Custom-Header
119+
access-control-allow-origin: https://8000--dev--user--apps.dev.coder.com
120+
vary: Origin
121+
vary: Access-Control-Request-Method
122+
vary: Access-Control-Request-Headers
123+
```
124+
125+
The allowed origin will be set to the origin provided by the browser if the
126+
users are identical. Credentials are allowed and the allowed methods and headers
127+
will echo whatever the request sends.
128+
129+
### Configuration
130+
131+
These cross-origin headers are not configurable by administrative settings.
132+
133+
Applications can set their own headers which will override the defaults but this
134+
will only apply to non-preflight requests. Preflight requests are never sent to
135+
applications and thus cannot be modified by them. Read more about the difference
136+
between simple requests and requests that trigger preflights
137+
[here](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests).
138+
139+
### Allowed by default
140+
141+
<table class="tg">
142+
<thead>
143+
<tr>
144+
<th class="tg-0pky" rowspan="2"></th>
145+
<th class="tg-0pky" rowspan="3"></th>
146+
<th class="tg-0pky">From</th>
147+
<th class="tg-0pky" colspan="3">Alice</th>
148+
<th class="tg-0pky">Bob</th>
149+
</tr>
150+
<tr>
151+
<th class="tg-0pky" rowspan="2"></th>
152+
<th class="tg-0pky">Workspace 1</th>
153+
<th class="tg-0pky" colspan="2">Workspace 2</th>
154+
<th class="tg-0pky">Workspace 3</th>
155+
</tr>
156+
<tr>
157+
<th class="tg-0pky">To</th>
158+
<th class="tg-0pky">App A</th>
159+
<th class="tg-0pky">App B</th>
160+
<th class="tg-0pky">App C</th>
161+
<th class="tg-0pky">App D</th>
162+
</tr>
163+
</thead>
164+
<tbody>
165+
<tr>
166+
<td class="tg-0pky" rowspan="3">Alice</td>
167+
<td class="tg-0pky" rowspan="2">Workspace 1</td>
168+
<td class="tg-0pky">App A</td>
169+
<td class="tg-0pky">✅</td>
170+
<td class="tg-0pky">✅<span style="font-weight:400;font-style:normal">*</span></td>
171+
<td class="tg-0pky">✅<span style="font-weight:400;font-style:normal">*</span></td>
172+
<td class="tg-0pky">❌</td>
173+
</tr>
174+
<tr>
175+
<td class="tg-0pky">App B</td>
176+
<td class="tg-0pky">✅*</td>
177+
<td class="tg-0pky">✅</td>
178+
<td class="tg-0pky">✅<span style="font-weight:400;font-style:normal">*</span></td>
179+
<td class="tg-0pky">❌</td>
180+
</tr>
181+
<tr>
182+
<td class="tg-0pky">Workspace 2</td>
183+
<td class="tg-0pky">App C</td>
184+
<td class="tg-0pky">✅<span style="font-weight:400;font-style:normal">*</span></td>
185+
<td class="tg-0pky">✅<span style="font-weight:400;font-style:normal">*</span></td>
186+
<td class="tg-0pky">✅</td>
187+
<td class="tg-0pky">❌</td>
188+
</tr>
189+
<tr>
190+
<td class="tg-0pky">Bob</td>
191+
<td class="tg-0pky">Workspace 3</td>
192+
<td class="tg-0pky">App D</td>
193+
<td class="tg-0pky">❌</td>
194+
<td class="tg-0pky">❌</td>
195+
<td class="tg-0pky">❌</td>
196+
<td class="tg-0pky">✅</td>
197+
</tr>
198+
</tbody>
199+
</table>
200+
201+
> '\*' means `credentials: "include"` is required

0 commit comments

Comments
 (0)