Don't check httponly cookie in dashboard
Open
Nobody has claimed this yet.
component: dashboard
meta: never-stale
team: webapp
- Dominant language
- TypeScript
- Stars
- 13.8k
- Forks
- 1.4k
- Avg merge
- 17h 58m
- Merged PRs (30d)
- 5
Description
We check and auth workspace cookie in workspace origin, but that cookie is httpOnly, which means this if will not work
| Cookie policy | Six requests from StartWorkspace.tsx |
|---|---|
 |
 |
How to reproduce
- Open workspace https://gitpod.new with browser code
- Exec
curl lama.sh | shto listen to port - Go to Ports tab next to Terminal tab in browser
- Switch port private/public state and check with Browser DevTools / Network or Console
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in components/dashboard/src/start/StartWorkspace.tsx at the linked code around line 381 and inspect how the workspace cookie is checked. Reproduce the port visibility change using the listed browser steps, then verify in DevTools that the port’s private/public state changes correctly without relying on the HttpOnly cookie.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, frontend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100