Method ValidWorkspaceAppHostname

coderd/workspaceapps.go:161–208

ValidWorkspaceAppHostname checks if the given host is a valid workspace app hostname based on the provided options. It returns a scheme to force on success. If the hostname is not valid or doesn't match, an empty string is returned. Any error returned is a 500 error. For hosts that match a wildcard

(ctx context.Context, host string, opts ValidWorkspaceAppHostnameOpts)

// For hosts that match a wildcard app hostname, the scheme is forced to be the
// corresponding access URL scheme.
func (api *API) ValidWorkspaceAppHostname(ctx context.Context, host string, opts ValidWorkspaceAppHostnameOpts) (string, error) {
	if opts.AllowPrimaryAccessURL && (host == api.AccessURL.Hostname() || host == api.AccessURL.Host) {
		// Force the redirect URI to have the same scheme as the access URL for
		// security purposes.
		return api.AccessURL.Scheme, nil
	}

	if opts.AllowPrimaryWildcard && api.AppHostnameRegex != nil {
		_, ok := appurl.ExecuteHostnamePattern(api.AppHostnameRegex, host)
		if ok {
			// Force the redirect URI to have the same scheme as the access URL
			// for security purposes.
			return api.AccessURL.Scheme, nil
		}
	}

	// Ensure that the redirect URI is a subdomain of api.Hostname and is a
	// valid app subdomain.
	if opts.AllowProxyAccessURL || opts.AllowProxyWildcard {
		// Strip the port for the database query.
		host = strings.Split(host, ":")[0]

		// nolint:gocritic // system query
		systemCtx := dbauthz.AsSystemRestricted(ctx)
		proxy, err := api.Database.GetWorkspaceProxyByHostname(systemCtx, database.GetWorkspaceProxyByHostnameParams{
			Hostname:              host,
			AllowAccessUrl:        opts.AllowProxyAccessURL,
			AllowWildcardHostname: opts.AllowProxyWildcard,
		})
		if xerrors.Is(err, sql.ErrNoRows) {
			return "", nil
		}
		if err != nil {
			return "", xerrors.Errorf("get workspace proxy by hostname %q: %w", host, err)
		}

		proxyURL, err := url.Parse(proxy.Url)
		if err != nil {
			return "", xerrors.Errorf("parse proxy URL %q: %w", proxy.Url, err)
		}

		// Force the redirect URI to use the same scheme as the proxy access URL
		// for security purposes.
		return proxyURL.Scheme, nil
	}

	return "", nil
}