Add Origin header validation to CDP proxy WebSocket server - #2668
Joaquin Jares (joj) merged 7 commits into
Conversation
Reject WebSocket connections that include an Origin header, as only the raw vscode-js-debug client should connect to the CDP proxy. Co-authored-by: Copilot <[email protected]>
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
Hi lucygramley ， Thanks for the contribution and for the CDP proxy hardening work here. Could you please create or link a corresponding issue for this PR? It would help us track the security motivation, affected surface, and expected client behavior separately from the implementation. Also, the PR validation is currently failing on Linux, Windows, and macOS in the unit test pipeline. Could you please take a look at the failing test logs and update the PR accordingly? For this change specifically, it would be helpful to confirm that rejecting every WebSocket connection with an |
Head branch was pushed to by a user without write access
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Reject WebSocket connections that include an Origin header in the CDP proxy. Only the raw vscode-js-debug WebSocket client should connect to the proxy, and it does not send an Origin header.