GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix(coderd): enforce required external auth on workspace create by dylanhuff-at-coder · Pull Request #26314 · coder/coder

Conversation

@dylanhuff-at-coder

@dylanhuff-at-coder dylanhuff-at-coder commented Jun 11, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Required external auth (optional = false) was only enforced by client-side preflight checks, so creating a workspace via the REST API succeeded even when the owner had never authenticated, producing a broken workspace.

createWorkspace now validates the workspace owner's external auth server-side and returns 403 before any row is inserted or prebuild is claimed. The owner (not the initiator) is checked because build-time token injection uses their links, so this also covers admin-on-behalf-of creates and prebuild claims. Use optional = true to allow pre-provisioning for unauthenticated users.

Fixes PLAT-241.

This PR was generated by Coder Agents on behalf of @dylanhuff-at-coder.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@dylanhuff-at-coder
fix(coderd): enforce required external auth on workspace create
a11b423 
Required external auth was only enforced by client-side preflight checks
in the CLI and UI, so creating a workspace directly through the REST API
succeeded even when the owner had not authenticated with a required
provider. The build then ran with an empty token and produced a broken
workspace.

Workspace creation now validates the workspace owner's external auth
links against the template version's non-optional providers before any
workspace row is inserted or prebuilt workspace is claimed, returning
403 with one validation entry per missing provider. The owner is the
subject of the check, not the initiator, because build-time token
injection uses the owner's links.
@linear-code

linear-code Bot commented Jun 11, 2026

Copy link
Copy Markdown

PLAT-241
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions github-actions Bot assigned dylanhuff-at-coder Jun 11, 2026
@dylanhuff-at-coder
dylanhuff-at-coder marked this pull request as ready for review June 23, 2026 16:26
aslilac
aslilac approved these changes Jun 25, 2026
View reviewed changes

@aslilac aslilac left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

very nice fix. thanks!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread coderd/templateversions.go
err := json.Unmarshal(templateVersion.ExternalAuthProviders, &rawProviders)
if err != nil {
httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
return nil, httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{

@aslilac aslilac Jun 25, 2026

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this new? I like it

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@dylanhuff-at-coder dylanhuff-at-coder Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not new — httperror.NewResponseError/WriteResponseError have been around since #18719. I just pulled this out into templateVersionExternalAuthForUser so it returns the error instead of writing inline, which lets requireWorkspaceOwnerExternalAuth reuse it :)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@dylanhuff-at-coder dylanhuff-at-coder mentioned this pull request Jun 25, 2026
fix(coderd): enforce required external auth on task create #26718
Merged
@dylanhuff-at-coder
dylanhuff-at-coder merged commit fde3639 into main Jun 25, 2026
83 of 85 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@dylanhuff-at-coder
dylanhuff-at-coder deleted the dylan/plat-241-api-workspace-creation-bypasses-required-external-auth branch June 25, 2026 22:47
@github-actions github-actions Bot locked and limited conversation to collaborators Jun 25, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@aslilac aslilac aslilac approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@dylanhuff-at-coder dylanhuff-at-coder

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@dylanhuff-at-coder @aslilac
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.