…) (#26791)

backport of #26314 for the 2.33 branch.

Required external auth (`optional = false`) was only enforced by
client-side preflight checks, so creating a workspace via the REST API
succeeded even when the owner had never authenticated, producing a
broken workspace.

`createWorkspace` now validates the workspace owner's external auth
server-side and returns 403 before any row is inserted or prebuild is
claimed. The owner (not the initiator) is checked because build-time
token injection uses their links, so this also covers admin-on-behalf-of
creates and prebuild claims. Use `optional = true` to allow
pre-provisioning for unauthenticated users.

Fixes PLAT-241.

> This PR was generated by Coder Agents on behalf of
@dylanhuff-at-coder.

Co-authored-by: dylanhuff-at-coder <[email protected]>

…26819)

Backport of #26751

Original PR: #26751 — feat: add INSECURE oidc email fallback flag for
IdP brokers
Merge commit: ad355ae
Requested by: @uzair-coder07

> [!WARNING]
> The automatic cherry-pick had conflicts.
> Please resolve manually by cherry-picking the original merge commit:
>
> ```
> git fetch origin backport/26751-to-2.33
> git checkout backport/26751-to-2.33
> git reset --hard origin/release/2.33
> git cherry-pick -x -m1 ad355ae
> # resolve conflicts, then push
> ```

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Steven Masley <[email protected]>

…26923)

Backport of #26822

Original PR: #26822 — fix: correct gvisor replace directive to match
module path
Merge commit: f77d006
Requested by: @denisra

---
*Generated by [Coder Agents](https://coder.com/agents) on behalf of
@denisra*

Backport of #26890

Original PR: #26890 — fix(site): redirect to new organization after
create
Merge commit: 3e0875d
Requested by: @aslilac

Co-authored-by: McKayla はな <[email protected]>

…ntry (backport 2.33) (#27237)

Backports #26646 to release/2.33 (Security Support).

A client could spoof its X-Forwarded-For value by prepending a fake IP;
`getRemoteAddress` took the leftmost comma-delimited token, so appending
proxies (nginx, ALB, Cloudflare) never overrode the spoofed value. This
fed `httpmw.RateLimit` (per-IP login throttling) and audit log
`IPAddress` fields, enabling rate-limit bypass and audit falsification.

This is the security fix tracked in PLAT-258 /
coder/security-disclosures#9 (SEC-FC61DF2BF7). It already shipped in
mainline (v2.35.0); this PR brings it to the Security Support line.

Clean cherry-pick, no conflicts. `coderd/httpmw/realip_test.go` covers
the spoofing scenario.

Co-authored-by: Jon Ayers <[email protected]>

Backport of #27274

Original PR: #27274 — fix(coderd): harden oauth2 redirect validation
Merge commit: 2f87991
Requested by: @aslilac

Co-authored-by: McKayla はな <[email protected]>

Backport of #27544 to `release/2.33`.

Original PR: #27544 — fix(coderd): reject workspace proxy hostname
prefixes
Merge commit: 8cc7f2b

`release/2.33` is in the **Security Support** channel per the [release
schedule](https://coder.com/docs/install/releases#release-schedule) and
was the only in-scope branch still missing this security fix (2.29,
2.34, 2.35, and 2.36 were already backported via #27614, #27616, #27615,
and #27613).

Refs: https://linear.app/codercom/issue/PLAT-384

---

_This backport PR was created by Coder Agents on behalf of
@jdomeracki-coder._

Co-authored-by: George K <[email protected]>
Co-authored-by: Bobby Ho <[email protected]>