This repository was archived by the owner on Sep 12, 2026. It is now read-only.
feat: Signed-cookie auth gate for the /panel/dash reverse proxy - #21
Merged
mabry1985 merged 2 commits intoAug 28, 2026
Merged
Conversation
The full-mode dashboard proxy (/panel/dash + CDP screencast WS) loads in an iframe, which cannot carry an Authorization bearer — so on token-gated deployments it was reachable unauthenticated. Add a short-lived HMAC-signed ab_session cookie: a bearer-gated POST /dash-session mints it, and the /panel/dash proxy rejects a missing/tampered/expired cookie with 401. The signing key is per-boot + in-memory only. Non-token-gated deployments stay open (backward compatible). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…= exchange on /panel/dash) The review confirmed browsers drop a Path=/plugins/agent_browser/ cookie set from the POST /api/plugins/agent_browser/dash-session response — RFC 6265 path-matching requires the Set-Cookie URL to match the cookie Path, so token-gated deployments never retained the cookie and /panel/dash always 401'd. The bearer-gated POST now returns the signed token in the body; GET /panel/dash?dash=<token> exchanges it for the ab_session cookie, set from the proxy's own URL (path-matches by construction) with the Path derived from the request path so it also survives the fleet-proxy /agents/<slug> prefix. The panel's ensureDashSession() does mint → exchange before the WS connect. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mabry1985
deleted the
feat/bd-weta-signed-cookie-auth-gate-for-the-panel-da
branch
August 28, 2026 09:13
![protoreview[bot]](https://avatars.githubusercontent.com/in/4233969?s=60&v=4){kind=small}
There was a problem hiding this comment.
QA panel review — PASS
code-review-structural · head 0f1902dfad92 · formal
⚠️ PR advanced 1 commit(s) during this round (0f1902dfad92→b7f39fafd5db); 0 finding(s) in the delta were demoted to possibly addressed.
No code defects were identified by any review-finder on this PR. The one material concern is a process gap: the structural (security) pass failed to run, so the panel's "clean" verdict carries a known blind spot. Before merging, retry the structural pass so the security lane is actually covered. No findings to re-rank, dedup, or drop; the verifier confirmed the empty array is correct.
No findings — the review came back clean.
findings JSON (machine-readable)
[]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a short-lived signed-cookie auth gate so the interactive browser panel's full-mode dashboard proxy (
/panel/dash+ its CDP screencast WebSocket surface) can't be reached unauthenticated on token-gated deployments — the iframe that loads it cannot carry anAuthorizationbearer.POST /api/plugins/agent_browser/dash-session(under/api, so it inherits the host's operator-bearer gate) issues anab_sessioncookie:HttpOnly,SameSite=Strict, path-scoped to/plugins/agent_browser/,Max-Age=300(~5 min), andSecurewhen the origin (orX-Forwarded-Proto) is HTTPS. The value is an HMAC-signed<expiry>.<sig>token.GET /panel/dashvalidates the cookie (constant-time HMAC + expiry) and returns401on a missing / tampered / expired cookie when the deployment is token-gated (require_authconfig flag, set by the same host that applies the bearer gate). Non-token-gated deployments serve openly, unchanged — backward compatible.secrets.token_bytes(32), in-memory only; cookies can't outlive a restart and there's no key at rest to steal.POSTsdash-sessionviakit.apiFetch(carrying the bearer) insideconnect(), before the stream handshake, so the cookie is set before the proxied surface is reached.Tests cover the token round-trip/expiry/tamper cases, cookie attributes (HttpOnly / SameSite / path / Max-Age / Secure-on-HTTPS-and-XFP), the gated 401 paths, the valid-cookie 200 path, the non-gated backward-compatible path, and the client-side mint-before-connect wiring.
Fixes #9