mirror of
https://github.com/openai/codex.git
synced 2026-04-29 00:55:38 +00:00
6124564297
## Summary This change adds websocket authentication at the app-server transport boundary and enforces it before JSON-RPC `initialize`, so authenticated deployments reject unauthenticated clients during the websocket handshake rather than after a connection has already been admitted. During rollout, websocket auth is opt-in for non-loopback listeners so we do not break existing remote clients. If `--ws-auth ...` is configured, the server enforces auth during websocket upgrade. If auth is not configured, non-loopback listeners still start, but app-server logs a warning and the startup banner calls out that auth should be configured before real remote use. The server supports two auth modes: a file-backed capability token, and a standard HMAC-signed JWT/JWS bearer token verified with the `jsonwebtoken` crate, with optional issuer, audience, and clock-skew validation. Capability tokens are normalized, hashed, and compared in constant time. Short shared secrets for signed bearer tokens are rejected at startup. Requests carrying an `Origin` header are rejected with `403` by transport middleware, and authenticated clients present credentials as `Authorization: Bearer <token>` during websocket upgrade. ## Validation - `cargo test -p codex-app-server transport::auth` - `cargo test -p codex-cli app_server_` - `cargo clippy -p codex-app-server --all-targets -- -D warnings` - `just bazel-lock-check` Note: in the broad `cargo test -p codex-app-server connection_handling_websocket` run, the touched websocket auth cases passed, but unrelated Unix shutdown tests failed with a timeout in this environment. --------- Co-authored-by: Eric Traut <etraut@openai.com>
104 lines
3.0 KiB
TOML
104 lines
3.0 KiB
TOML
[package]
|
|
name = "codex-app-server"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[[bin]]
|
|
name = "codex-app-server"
|
|
path = "src/main.rs"
|
|
|
|
[[bin]]
|
|
name = "codex-app-server-test-notify-capture"
|
|
path = "src/bin/notify_capture.rs"
|
|
|
|
[lib]
|
|
name = "codex_app_server"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
base64 = { workspace = true }
|
|
axum = { workspace = true, default-features = false, features = [
|
|
"http1",
|
|
"json",
|
|
"tokio",
|
|
"ws",
|
|
] }
|
|
codex-arg0 = { workspace = true }
|
|
codex-cloud-requirements = { workspace = true }
|
|
codex-core = { workspace = true }
|
|
codex-exec-server = { workspace = true }
|
|
codex-features = { workspace = true }
|
|
codex-git-utils = { workspace = true }
|
|
codex-otel = { workspace = true }
|
|
codex-shell-command = { workspace = true }
|
|
codex-utils-cli = { workspace = true }
|
|
codex-utils-pty = { workspace = true }
|
|
codex-backend-client = { workspace = true }
|
|
codex-file-search = { workspace = true }
|
|
codex-chatgpt = { workspace = true }
|
|
codex-login = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-app-server-protocol = { workspace = true }
|
|
codex-feedback = { workspace = true }
|
|
codex-rmcp-client = { workspace = true }
|
|
codex-sandboxing = { workspace = true }
|
|
codex-state = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-json-to-toml = { workspace = true }
|
|
chrono = { workspace = true }
|
|
clap = { workspace = true, features = ["derive"] }
|
|
constant_time_eq = { workspace = true }
|
|
futures = { workspace = true }
|
|
hmac = { workspace = true }
|
|
jsonwebtoken = { workspace = true }
|
|
owo-colors = { workspace = true, features = ["supports-colors"] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
time = { workspace = true }
|
|
toml = { workspace = true }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
] }
|
|
tokio-util = { workspace = true }
|
|
tokio-tungstenite = { workspace = true }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
tracing-subscriber = { workspace = true, features = ["env-filter", "fmt", "json"] }
|
|
uuid = { workspace = true, features = ["serde", "v7"] }
|
|
|
|
[dev-dependencies]
|
|
app_test_support = { workspace = true }
|
|
base64 = { workspace = true }
|
|
axum = { workspace = true, default-features = false, features = [
|
|
"http1",
|
|
"json",
|
|
"tokio",
|
|
] }
|
|
core_test_support = { workspace = true }
|
|
codex-utils-cargo-bin = { workspace = true }
|
|
opentelemetry = { workspace = true }
|
|
opentelemetry_sdk = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
reqwest = { workspace = true, features = ["rustls-tls"] }
|
|
rmcp = { workspace = true, default-features = false, features = [
|
|
"elicitation",
|
|
"server",
|
|
"transport-streamable-http-server",
|
|
] }
|
|
serial_test = { workspace = true }
|
|
tokio-tungstenite = { workspace = true }
|
|
tracing-opentelemetry = { workspace = true }
|
|
wiremock = { workspace = true }
|
|
shlex = { workspace = true }
|