Skip to content

fix: guard /_vs/ routes behind Nginx auth_request#17

Merged
Vtec234 merged 3 commits into
mainfrom
auth
May 11, 2026
Merged

fix: guard /_vs/ routes behind Nginx auth_request#17
Vtec234 merged 3 commits into
mainfrom
auth

Conversation

@Vtec234
Copy link
Copy Markdown
Member

@Vtec234 Vtec234 commented May 7, 2026

Fixes #15.

@Vtec234 Vtec234 marked this pull request as ready for review May 7, 2026 21:29
@Vtec234 Vtec234 requested a review from jcreedcmu May 7, 2026 21:29
import { getEditorSessionManager } from '@/lib/server/editorSessions'
import { forbidden } from 'next/navigation'

/** Queried by Nginx to ensure the sending user can access the given editor session. */
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add a comment that 2xx will count as "success" from the point of view of nginx auth_request

Comment thread src/app/api/auth-vsc/[sessionId]/route.ts Outdated
Co-authored-by: Wojciech Nawrocki <13901751+Vtec234@users.noreply.github.com>
@Vtec234 Vtec234 merged commit 8ce097b into main May 11, 2026
1 check passed
@Vtec234 Vtec234 deleted the auth branch May 11, 2026 15:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Session hijacking risk

2 participants