Fixes unhandled v1 prefixed 'web/config.js' path#51364
Merged
Conversation
flyinghermit
approved these changes
Jan 22, 2025
avatus
approved these changes
Jan 22, 2025
| // part[1] is the prefix "v1" | ||
| switch pathParts[2] { | ||
| case "webapi", "enterprise", "scripts", ".well-known", "workload-identity": | ||
| case "webapi", "enterprise", "scripts", ".well-known", "workload-identity", "web": |
Contributor
There was a problem hiding this comment.
are we sure we want to include every request that is prefixed with web or only web/config.js?
Contributor
Author
There was a problem hiding this comment.
i think it's fine because we are just saying if /v1/web strip the /v1
public-teleport-github-review-bot
Bot
removed request for
codingllama and
tcsc
zmb3
approved these changes
Jan 22, 2025
kimlisa
force-pushed
the
lisa/fix-api-path
branch
from
b1d2a65 to
2c91dc8
Compare
Member
|
I know that some on-call devs use At the last offsite I've been to, I've also briefly talked with Hugo and Tiago about refactoring it to return plain JS, because now it essentially allows any code to be injected into the Web UI. |
carloscastrojumo
pushed a commit
to carloscastrojumo/teleport
that referenced
this pull request
Feb 19, 2025
* Fixes bug where /v1/web/config.js wasn't properly handled because of v1 prefix * Fix lint
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fixes #51362
starting v17.2.0, PR #50472 goes into affect where the
lib/web/apiserver.go:NewHandlernow checks for a fixed list of known paths after a/v1prefix, before stripping of the/v1.Teleport Connect users (with versions below v17.2.0) were unable to login to clusters with versions v17.2.0, because connect calls this endpoint web/config.js with
v1prefixed, wherewebwasn't part of the list of known paths so/v1/web/config.jsdidn't get handledThe
WebClient.endpointfunc would auto prefix endpoints withv1because that's how it was configured. #50472 removes this configuration and i missed theweb/configI went through all use cases of
webclient.endpointto make sure no other paths were unhandled. Tested fix with branch/v16 connect and master clusterchangelog: Fix backwards compatibility error where users were unable to login with Teleport Connect if Connect version is below v17.2.0 with Teleport cluster version v17.2.0