fix(site): centralize UUID generation and fix non-secure crash - #28285
Merged
Conversation
Add a generateUUID helper to site/src/utils/random.ts and route the uuid v4 and crypto.randomUUID call sites through it.
phorcys420
marked this pull request as draft
August 19, 2026 00:18
The uuid package's v4 compiles down to a crypto.randomUUID call in the production bundle, which is undefined in insecure contexts and throws "crypto.randomUUID is not a function" when Coder is served over plain HTTP (OSS-38). Derive the UUID from crypto.getRandomValues, which is available in insecure contexts, and only use crypto.randomUUID when it exists.
No longer imported after centralizing UUID generation on generateUUID. Also shorten the generateUUID doc comment.
phorcys420
marked this pull request as ready for review
August 19, 2026 01:53
Member
Author
|
i did review the pixel shots and they're fine so i approved them but i'm unsure how to get CI to pass, also i did reproduce that it stack traced before in an http context (accessing develop.sh instance via Coder Connect) and it doesn't anymore. |
Member
Author
|
(turns out this basically does what #27709 undid) |
|
|
||
| it("produces a valid UUID without crypto.randomUUID (insecure context)", () => { | ||
| const descriptor = Object.getOwnPropertyDescriptor(crypto, "randomUUID"); | ||
| Object.defineProperty(crypto, "randomUUID", { |
Contributor
There was a problem hiding this comment.
can we use vi.stubGlobal in the unit tests instead?
Member
Author
There was a problem hiding this comment.
sure tbh claude did this
Member
Author
There was a problem hiding this comment.
oh yeah this is horrible haha my bad
Contributor
There was a problem hiding this comment.
oh no worries! claude LOVES stubbing with Object.defineProperty, see it all the time
jeremyruppel
approved these changes
Aug 19, 2026
jeremyruppel
left a comment
Contributor
There was a problem hiding this comment.
nice! thanks for finding and fixing this!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes OSS-38:
crypto.randomUUID is not a functionwhen accessing Coder over plain HTTP.Root cause
crypto.randomUUIDis only defined in secure contexts (HTTPS or localhost). It isundefinedwhen Coder is served over plain HTTP. Theuuidpackage'sv4()short-circuits tocrypto.randomUUID()when it is truthy, and in the production bundle that path compiles down to a directcrypto.randomUUID()call, souuidv4()throws over HTTP. Observed crash (Template Builder, in theuseMemothat mints the telemetry session ID):The same
uuidv4()path backed the Terminal reconnection token and the Agent chat tab IDs / reconnection tokens, so those flows were affected too.Fix
Add a single
generateUUIDhelper insite/src/utils/random.tsthat derives the UUID fromcrypto.getRandomValues(the oneCryptomember available in insecure contexts) and only callscrypto.randomUUIDwhen it actually exists. Route all client-side UUID generation through it, so every call site is fixed at once and future ones stay safe.Changes
utils/random.ts— newgenerateUUID()helperTemplateBuilderPage.tsx— telemetry session ID/templates/new/builderTerminalPage.tsx— reconnection token/:username/:workspace/terminalAgentChatPageView.tsx— tab IDs + reconnection tokens/agents/:agentIduseChatDraftAttachments.ts— draft client IDs/agents/:agentIdTaskApps.stories.tsx— mock app IDs (Storybook)/tasks/:username/:taskIdWorkspaceSharingIndicator.stories.tsx— mock actor IDs (Storybook)/workspacesuuid/@types/uuiddirect depsuuidis still pinned via apnpm.overridesentry becausemermaid/streamdowndepend on it transitively.Tests
random.test.tscovers a valid UUID, uniqueness, and the insecure-context path (withcrypto.randomUUIDstubbed toundefined).TerminalPage.test.tsxnow mocks#/utils/randominstead of theuuidmodule.Validation
make fmt,biome check,tsc --noEmitcleanvitest rungreen:random.test.ts(6),TerminalPage.test.tsx(16),useChatDraftAttachments.test.ts(17), both changed stories (12)uuidv4()in Template Builder.This PR was generated by Coder Agents on behalf of @phorcys420.