Skip to content

feat: use environment variables for CLI auth instead of file flags #663

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ibetitsmike wants to merge 1 commit into from
Closed

feat: use environment variables for CLI auth instead of file flags #663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions src/core/cliManager.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -710,10 +710,10 @@ export class CliManager {
}

/**
* Update the URL for the deployment with the provided label on disk which can
* be used by the CLI via --url-file. If the URL is falsey, do nothing.
* Update the URL for the deployment with the provided label on disk for
* persistence. If the URL is falsey, do nothing.
*
* If the label is empty, read the old deployment-unaware config instead.
* If the label is empty, use the old deployment-unaware path instead.
*/
private async updateUrlForCli(
label: string,
Expand All @@ -728,10 +728,9 @@ export class CliManager {

/**
* Update the session token for a deployment with the provided label on disk
* which can be used by the CLI via --session-token-file. If the token is
* null, do nothing.
* for persistence. If the token is null, do nothing.
*
* If the label is empty, read the old deployment-unaware config instead.
* If the label is empty, use the old deployment-unaware path instead.
*/
private async updateTokenForCli(
label: string,
Expand Down
14 changes: 8 additions & 6 deletions src/remote/remote.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,6 +479,8 @@ export class Remote {
binaryPath,
logDir,
featureSet,
baseUrlRaw,
token,
);
} catch (error) {
this.logger.warn("Failed to configure SSH", error);
Expand Down Expand Up @@ -597,6 +599,8 @@ export class Remote {
binaryPath: string,
logDir: string,
featureSet: FeatureSet,
url: string,
token: string,
) {
let deploymentSSHConfig = {};
try {
Expand Down Expand Up @@ -677,9 +681,7 @@ export class Remote {
? `${escapeCommandArg(binaryPath)}${globalConfigs} ssh --stdio --usage-app=vscode --disable-autostart --network-info-dir ${escapeCommandArg(this.pathResolver.getNetworkInfoPath())}${await this.formatLogArg(logDir)} --ssh-host-prefix ${hostPrefix} %h`
: `${escapeCommandArg(binaryPath)}${globalConfigs} vscodessh --network-info-dir ${escapeCommandArg(
this.pathResolver.getNetworkInfoPath(),
)}${await this.formatLogArg(logDir)} --session-token-file ${escapeCommandArg(this.pathResolver.getSessionTokenPath(label))} --url-file ${escapeCommandArg(
this.pathResolver.getUrlPath(label),
)} %h`;
Comment on lines -680 to -682
Copy link
Collaborator

@EhabY EhabY Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This removes the session token and URL file from being passed to vscodessh which is the old client that I think is only used by some older servers (< 2.19.0)

)}${await this.formatLogArg(logDir)} %h`;

const sshValues: SSHValues = {
Host: hostPrefix + `*`,
Expand All @@ -690,9 +692,9 @@ export class Remote {
LogLevel: "ERROR",
};
if (sshSupportsSetEnv()) {
Copy link
Collaborator

@EhabY EhabY Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't this just fail if the SSH does not support SetEnv? is it possible to have this as a fallback?

// This allows for tracking the number of extension
// users connected to workspaces!
sshValues.SetEnv = " CODER_SSH_SESSION_TYPE=vscode";
// Pass Coder URL, session token, and session type via environment.
// The CLI reads CODER_URL and CODER_SESSION_TOKEN from the environment.
sshValues.SetEnv = ` CODER_URL=${url} CODER_SESSION_TOKEN=${token} CODER_SSH_SESSION_TYPE=vscode`;
Copy link
Collaborator

@EhabY EhabY Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here we still have the token in plaintext but it's now in <globalDir>/<deployment url>/session and in the proxy command (somewhere in ~/.ssh/config?)

}

await sshConfig.update(label, sshValues, sshConfigOverrides);
Expand Down