chore: override codersdk.SessionTokenCookie in develop.sh by johnstcn · Pull Request #18991 · coder/coder

johnstcn · 2025-07-22T16:58:52Z

Enables viewing the Coder UI proxied by Coder.
Exposes an environment variable CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX which allows adding a prefix to the name of the session token cookie. This only works for development builds.

$ CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX=dev ./scripts/develop.sh

$ curl 'https://3000--dev--nonix--cian--apps.dev.coder.com/api/v2/users/me' -H "Cookie: dev_coder_session_token=$(cat .coderv2/session)"
{"id":"fddc81ff-7924-4628-a146-b799d2fb81b4","username":"admin","name":"Admin User","email":"admin@coder.com","created_at":"2025-07-22T13:39:16.670833+01:00","updated_at":"2025-07-22T17:49:38.313364+01:00","last_seen_at":"2025-07-22T16:49:38.313364Z","status":"active","login_type":"password","organization_ids":["c56e87ca-effa-43a6-a464-f25840a47483"],"roles":[{"name":"owner","display_name":"Owner"}]}

EDIT: I tried an alternative implementation instead using -ldflags -X that removes the need for most changes in codersdk.

johnstcn · 2025-07-22T17:05:30Z

 			},
 		},
-		allowedHosts: [".coder"],
+		allowedHosts: [".coder", ".dev.coder.com"],


review: also updated allowedHosts for dev URLs.

johnstcn · 2025-07-22T17:05:52Z


 	cdroot
-	DEBUG_DELVE="${debug}" start_cmd API "" "${CODER_DEV_SHIM}" server --http-address 0.0.0.0:3000 --swagger-enable --access-url "${CODER_DEV_ACCESS_URL}" --dangerous-allow-cors-requests=true --enable-terraform-debug-mode "$@"
+	DEBUG_DELVE="${debug}" CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX="${CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX}" start_cmd API "" "${CODER_DEV_SHIM}" server --http-address 0.0.0.0:3000 --swagger-enable --access-url "${CODER_DEV_ACCESS_URL}" --dangerous-allow-cors-requests=true --enable-terraform-debug-mode "$@"


review: I'm setting the prefix to dev_ by default in develop.sh.

code-asher

I tried it out and it is glorious we can run Coder over dev URLs now 🎉

Too bad we cannot get rid of codersdk.SessionTokenCookie or set it dynamically (at least not as a const), but what can ya do.

Emyrk · 2025-07-22T18:08:41Z

+func GetSessionTokenCookie() string {
+	if buildinfo.IsDev() {
+		if pfx, found := os.LookupEnv("CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX"); found && pfx != "" {
+			return pfx + "_" + SessionTokenCookie
+		}
+	}
+	return SessionTokenCookie
+}


Should SessionTokenCookie just be a var? And a function updates the var?

At the very least, SessionTokenCookie should probably not be exported. Just this function

Yeah I was thinking of doing that but didn't want to make a breaking API change.
But you got me thinking... what do we do for buildinfo.tag?
If I change SessionTokenCookie to a var we can just do the -ldflags -X trick and not have to change anything else :)

bpmct · 2025-07-22T19:09:00Z

woooooooooo!!!!

This reverts commit 9ce2437.

johnstcn · 2025-07-22T22:14:20Z

-// From codersdk/client.go
-export const SessionTokenCookie = "coder_session_token";
-


This isn't intentional; I need to figure out how to keep this around.
@Emyrk think it's possible to modify this behaviour in apitypings?

For now I'm manually vendoring this into api.ts.

johnstcn · 2025-07-22T22:15:47Z

+if [[ "$develop_in_coder" == 1 ]]; then
+	echo "INFO : Overriding codersdk.SessionTokenCookie as we are developing inside a Coder workspace."
+	ldflags+=(
+		-X "'github.com/coder/coder/v2/codersdk.SessionTokenCookie=dev_coder_session_token'"
+	)
+fi


I decided to try this way instead. It's a little more involved but requires less code changes in codersdk. I can remove the echo message if it's annoying.

mtojek

Excellent!!

johnstcn · 2025-07-23T11:25:32Z

+/**
+ * Originally from codersdk/client.go.
+ * The below declaration is required to stop Knip from complaining.
+ * @public
+ */
+export const SessionTokenCookie = "coder_session_token";


matifali · 2025-07-23T13:15:04Z

 CODER_DELVE_DEBUG_BIN=$(realpath "./build/coder_debug_${GOOS}_${GOARCH}")
 popd

+if [ -n "${CODER_AGENT_URL}" ]; then


We could also check if CODER=true. That's what I do in my dotfiles.

I forgot about that one!

Should also maybe be "${CODER_AGENT_URL:-}" in case the env var is not set, on account of the set -u.

I did that here above (L13) but missed it in develop.sh. Will push a separate PR 👍

#19043

Oh right oops! I got lost in what script I was looking at lol

johnstcn added 3 commits July 22, 2025 16:55

feat: allow prefixing coder_session_token cookie

9ce2437

chore: add dev.coder.com to vite allowedHosts

5497686

chore: set CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX in develop.sh

5868b0b

johnstcn self-assigned this Jul 22, 2025

johnstcn changed the title ~~Cj/dev session token cookie prefix~~ chore: add CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX in development mode Jul 22, 2025

johnstcn requested review from Emyrk, code-asher and mtojek July 22, 2025 17:03

johnstcn commented Jul 22, 2025

View reviewed changes

code-asher approved these changes Jul 22, 2025

View reviewed changes

Emyrk reviewed Jul 22, 2025

View reviewed changes

johnstcn added 2 commits July 22, 2025 22:23

Revert "feat: allow prefixing coder_session_token cookie"

6c86d8c

This reverts commit 9ce2437.

chore: use ldflags to override codersdk.SessionTokenCookie at build

a2dcf61

johnstcn commented Jul 22, 2025

View reviewed changes

johnstcn changed the title ~~chore: add CODER_DEV_SESSION_TOKEN_COOKIE_PREFIX in development mode~~ chore: override codersdk.SessionTokenCookie in develop.sh Jul 22, 2025

mtojek approved these changes Jul 23, 2025

View reviewed changes

re-add missing autogenerated export manually

cb6b8b3

mtojek approved these changes Jul 23, 2025

View reviewed changes

make knip shut up

f4e5a14

johnstcn commented Jul 23, 2025

View reviewed changes

johnstcn merged commit bb83071 into main Jul 23, 2025
65 of 71 checks passed

johnstcn deleted the cj/dev-session-token-cookie-prefix branch July 23, 2025 11:48

github-actions Bot locked and limited conversation to collaborators Jul 23, 2025

matifali reviewed Jul 23, 2025

View reviewed changes

		// From codersdk/client.go
		export const SessionTokenCookie = "coder_session_token";

Conversation

johnstcn commented Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

code-asher left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bpmct commented Jul 22, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnstcn Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mtojek left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

code-asher Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnstcn Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

johnstcn commented Jul 22, 2025 •

edited

Loading

code-asher left a comment •

edited

Loading

johnstcn Jul 22, 2025 •

edited

Loading

code-asher Jul 24, 2025 •

edited

Loading

johnstcn Jul 25, 2025 •

edited

Loading