Function TestCSRFExempt

coderd/coderd_test.go:353–411

(t *testing.T)

}

func TestCSRFExempt(t *testing.T) {
	t.Parallel()

	// This test build a workspace with an agent and an app. The app is not
	// a real http server, so it will fail to serve requests. We just want
	// to make sure the failure is not a CSRF failure, as path based
	// apps should be exempt.
	t.Run("PathBasedApp", func(t *testing.T) {
		t.Parallel()

		client, _, api := coderdtest.NewWithAPI(t, nil)
		first := coderdtest.CreateFirstUser(t, client)
		owner, err := client.User(context.Background(), "me")
		require.NoError(t, err)

		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
		defer cancel()

		// Create a workspace.
		const agentSlug = "james"
		const appSlug = "web"
		wrk := dbfake.WorkspaceBuild(t, api.Database, database.WorkspaceTable{
			OwnerID:        owner.ID,
			OrganizationID: first.OrganizationID,
		}).
			WithAgent(func(agents []*proto.Agent) []*proto.Agent {
				agents[0].Name = agentSlug
				agents[0].Apps = []*proto.App{{
					Slug:        appSlug,
					DisplayName: appSlug,
					Subdomain:   false,
					Url:         "/",
				}}

				return agents
			}).
			Do()

		u := client.URL.JoinPath(fmt.Sprintf("/@%s/%s.%s/apps/%s", owner.Username, wrk.Workspace.Name, agentSlug, appSlug)).String()
		req, err := http.NewRequestWithContext(ctx, http.MethodPost, u, nil)
		req.AddCookie(&http.Cookie{
			Name:   codersdk.SessionTokenCookie,
			Value:  client.SessionToken(),
			Path:   "/",
			Domain: client.URL.String(),
		})
		require.NoError(t, err)

		resp, err := client.HTTPClient.Do(req)
		require.NoError(t, err)
		data, _ := io.ReadAll(resp.Body)
		_ = resp.Body.Close()

		// A StatusNotFound means Coderd tried to proxy to the agent and failed because the agent
		// was not there. This means CSRF did not block the app request, which is what we want.
		require.Equal(t, http.StatusNotFound, resp.StatusCode, "status code 500 is CSRF failure")
		require.NotContains(t, string(data), "CSRF")
	})