diff --git a/coderd/coderd.go b/coderd/coderd.go index d8e9d96ff7106..72ebce81120fa 100644 --- a/coderd/coderd.go +++ b/coderd/coderd.go @@ -464,8 +464,16 @@ func New(options *Options) *API { r := chi.NewRouter() // We add this middleware early, to make sure that authorization checks made // by other middleware get recorded. + //nolint:revive,staticcheck // This block will be re-enabled, not going to remove it if buildinfo.IsDev() { - r.Use(httpmw.RecordAuthzChecks) + // TODO: Find another solution to opt into these checks. + // If the header grows too large, it breaks `fetch()` requests. + // Temporarily disabling this until we can find a better solution. + // One idea is to include checking the request for `X-Authz-Record=true` + // header. To opt in on a per-request basis. + // Some authz calls (like filtering lists) might be able to be + // summarized better to condense the header payload. + // r.Use(httpmw.RecordAuthzChecks) } ctx, cancel := context.WithCancel(context.Background())