Account for hosts with/without ports in origin check
- Dominant language
- TypeScript
- Stars
- 79.3k
- Forks
- 6.8k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 41
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### OS/Web Information
N/A
### Steps to Reproduce
You can simulate with this NGINX config:
```
proxy_set_header X-Forwarded-Host $host:$server_port;
```
### Expected
If your origin is `https://domain.tld` and your host is `domain.tld:443` the check should pass. Same for `http://domain.tld` and `domain.tld:80`.
Also I think NGINX's `$host` actually does not include ports so it will fail if your config only has `$host` and if you host on a port other than 443 and 80 since you would get an origin like `https://domain.tld:8080` and the host would be `domain.tld`.
To fix the first we could just check the protocol on the origin and then add/remove 443 or 80.
For the second we could ignore the port altogether since I think the vulnerability does not happen across ports...
But I am not sure we should do anything; maybe the correct course of action is to edit the proxy config so the host and origin headers match. I have looked at other software but they all seem to do exact matches without messing around with the port. We could just edit the documentation to use `$http_host`.
### Actual
The origin and domain are matched exactly so they do not match. Ends up causing the web sockets to fail with 1006.
### Logs
_No response_
### Screenshot/Video
_No response_
### Does this issue happen in VS Code or GitHub Codespaces?
- [X] I cannot reproduce this in VS Code.
- [X] I cannot reproduce this in GitHub Codespaces.
### Are you accessing code-server over HTTPS?
- [X] I am using HTTPS.
### Notes
https://github.com/coder/code-server/issues/6161
Might be causing issues reported in https://github.com/coder/code-server/issues/6023 and https://github.com/coder/code-server/issues/6064 as well.
And possibly https://github.com/coder/code-server/issues/6014
Contributor guide
Assessment
This issue has not been assessed yet.