[pipeline-manager] Fix ad-hoc not working in Chromium-based browsers by confirming the requested subprotocol#6711
Open
Karakatiza666 wants to merge 2 commits into
Open
[pipeline-manager] Fix ad-hoc not working in Chromium-based browsers by confirming the requested subprotocol#6711Karakatiza666 wants to merge 2 commits into
Karakatiza666 wants to merge 2 commits into
Conversation
…by confirming the requested subprotocol Signed-off-by: Karakatiza666 <bulakh.96@gmail.com>
Karakatiza666
enabled auto-merge
July 23, 2026 12:55
Signed-off-by: feldera-bot <feldera-bot@feldera.com>
mythical-fred
approved these changes
Jul 23, 2026
mythical-fred
left a comment
There was a problem hiding this comment.
Good fix. Chromium follows the WHATWG WebSocket handshake step that requires the server to echo one of the offered subprotocols; when the client offers feldera-bearer.* / feldera-tenant.* and the manager echoes none, the browser aborts with 1006. Introducing a non-secret sentinel feldera-ws-v1 and echoing it (falling back to the first offered protocol for older consoles) is the right shape. Tests cover the three interesting cases: no offer, sentinel-preferred, sentinel out of order, and the legacy fallback. Non-blocking notes:
- Handshake response can never contain a pre-existing
Sec-WebSocket-Protocolheader fromactix_ws::handle, soinsert(notappend) is correct — worth a one-line comment to that effect for the next reader. - The
HeaderValue::from_strbranch silently drops the header on error. All valid subprotocol tokens are ASCII-visible (already parsed once by actix), so the branch is unreachable in practice; awarn!there would still make it discoverable if the invariant ever changes. - Trailing space on the
///line aboveselect_ws_subprotocol's last paragraph — trivial.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The issue is web-console uses websocket subprotocol headers to pass the auth information to pipeline-manager, but for a successful websocket handshake the browser needs to receive at least one subprotocol back. The existing handler in pipeline-manager does not do that, so a custom code for that was needed. The ad-hoc queries were broken when authentication is enabled in chromium-based browsers but not Firefox, because the latter is more relaxed regarding this rule and allows ws connections without this handshake
The issue manifested as not being able to use adhoc queries through web-console in a chromium-based browser while auth is enabled - a visible error on any query
Testing: manual, added unit tests