Send attestation tokens on login-server requests - #736
Conversation
Add setAttestationToken and attach x-attestation-token so attested clients can skip CAPTCHA challenges from the login server. Validate private LAN hosts via real IPv4 octets (not DNS prefix matches), update the rejection message, and treat empty-string attestation tokens as cleared.
|
Current version of PR was reviewed by /review-bugbot with additional instructions on Aug 13, 21:44 PDT. It flagged 0 findings. Bugbot on commit |
|
|
||
| if (url.protocol === 'http:' || url.protocol === 'ws:') { | ||
| if (url.hostname === 'localhost') return | ||
| if (isPrivateHost(url.hostname)) return |
There was a problem hiding this comment.
Side effect on fake-world routing: makeFakeWorld with allowNetworkAccess: true routes fetches by "passes validateServer -> fakeFetch, throws -> real network" (src/core/fake/fake-world.ts). Private-IP URIs now pass, so a fake-world test pointed at a real LAN dev server (the exact use case this PR enables) silently gets answered by the in-memory fake server instead of the network. If that is not intended, the fake-world path may want to keep the old localhost-only check.
| /** | ||
| * We only accept *.edge.app or localhost as valid domain names. | ||
| * We only accept *.edge.app, localhost, or (for http/ws only) private LAN IPv4. | ||
| * https/wss still require localhost or *.edge(test)?.app — private IPs are not |
There was a problem hiding this comment.
Nit: em-dash in the comment; repo convention is zero em-dashes in committed code (comma or semicolon instead). Full ruleset: https://github.com/EdgeApp/edge-dev-agents/blob/main/.cursor/skills/no-slop/SKILL.md
2 participants
Summary
EdgeContext.setAttestationTokenand attachx-attestation-tokenon login-server/api/requests so attested clients can receive CAPTCHA rate overrides.http/wsserver overrides (still reject them forhttps/wss).Test plan
attestation-headertests: set / clear / empty-string token behaviorvalidateServertests: LANhttpaccepted; public IPs andhttpsLAN rejectedx-attestation-tokenonly when a token is set