code-server: [Bug]: Unable to forward remotehost:port

Great points and thank you for the links!!

I prefer the query parameter as well but I am concerned that the application itself might use query parameters and have one called ip or maybe it is an app with multiple pages and navigating to a page drops the ip query parameter.

If we embed it into the path on the other hand the application would not be able to mess it up.

We could make it a requirement that applications running behind code-server’s proxy specially treat the ip query variable if it exists but I could see that not going too well. XD

@code-asher @jsjoeio Please make sure that proxying is restricted to the following ranges:

IPv4

• 10.0.0.0/8^1
• 172.16.0.0/12^1
• 192.168.0.0/16^1

plus 127.0.0.1^2/localhost.

IPv6

• fc00::/7^3

plus ::1^4/localhost.

Proxying to arbitrary IPs must be prevented.
👉 Otherwise, this opens up an incredible number of (undesirable) use cases.

Ah yeah good point, I think we would need to add something like {{ip}} to VSCODE_PROXY_URI?

Only if format /proxy/{{ip}}/{{port}}/[path/to/page] is settled on.

But to prevent breakage maybe we can default to localhost when the endpoint is /proxy/{{ip}}/3000 or whatever format we settle on.

If format /proxy/{{port}}/[path/to/page]?ip=192.0.2.2^1 is settled on and query string parameter ip is unset I expect to default to localhost.

Uh I might have misread the question. For implementing maybe we can leave the IP alone if it is 172.*?

I don’t think so… If the IP is reachable, code-server should forward it. I don’t know how protocols like MySQL or MongoDB work in HTTPS… There should be some way!

I am facing relatively same problem. If I run a Node App on port 3000 via Code-Server container and NGinx Proxy module, it’s not accessible via url/proxy/3000 port. How to get rid of proxy/ and allow it like URL:3000 ?

I like the idea of a whitelist that you can extend or override through the config.yaml or command-line flags although it does seem pretty easy to bypass. You could spin up or write your own proxy, access it through code-server’s proxy, then access whatever you want anyway.

@benz0li I like how you think. So we will leave VSCODE_PROXY_URI alone. If for some reason applications/extensions do start needing to specify a non-localhost IP we can revisit. The algorithm you laid out for differentiating looks great to me as well.

@sibidharan Ahh I skipped over the part about non-HTTP protocols, thanks for pointing that out! Your solution makes sense to me.

But that means we need to encode the IP into the proxy URL somehow. /proxy/3000?ip=[ip] or /proxy/[ip]/3000 for example.

Actually we should just always leave the IP alone I think and when it is missing then we default to localhost.

I believe we have the proxy hardcoded to localhost right now so we will need to fix that.