Jakub Domeracki 0ba40523c8 fix(coderd): backport frame-ancestors CSP fixes to 2.29 (#24474, #24529) (#24808) ...

Cherry-pick backport of #24474 and #24529 to `release/2.29`.

- #24474: fix(coderd): add frame-ancestors CSP directive to prevent
clickjacking
- #24529: fix(coderd): omit frame-ancestors CSP for embed routes

Both commits cherry-picked cleanly with no conflicts.

> Generated by Coder Agents

2026-05-01 15:07:49 -04:00

..

loggermw

chore: add debug logging and recovery to agent api requests (#20785)

2025-11-25 14:59:20 -09:00

patternmatcher

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

actor_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

actor.go

feat: implement provisioner auth middleware and proper org params (#12330)

2024-03-04 15:15:41 -06:00

apikey_test.go

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

apikey.go

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

authorize_test.go

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

authz_test.go

fix: exit reset password request before passwords are compared (#13856)

2024-07-09 14:28:39 -05:00

authz.go

chore: make authz recorder opt in (#20310)

2025-10-21 14:15:37 +00:00

clitelemetry.go

refactor(coderd/telemetry): move CLI telemetry to cli/telemetry (#9517)

2023-09-04 21:42:45 +03:00

cors_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

cors.go

feat: add RFC 9728 OAuth2 resource metadata support (#18920)

2025-07-19 22:05:15 +02:00

csp_test.go

fix(coderd): backport frame-ancestors CSP fixes to 2.29 (#24474, #24529) (#24808)

2026-05-01 15:07:49 -04:00

csp.go

fix(coderd): backport frame-ancestors CSP fixes to 2.29 (#24474, #24529) (#24808)

2026-05-01 15:07:49 -04:00

csrf_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

csrf.go

feat: implement RFC 6750 Bearer token authentication (#18644)

2025-07-02 19:14:54 +02:00

experiments.go

feat: add MCP HTTP server experiment and improve experiment middleware (#18712)

2025-07-03 20:09:18 +02:00

externalauthparam_test.go

chore: move /gitauth to /externalauth on the frontend (#9954)

2023-09-30 14:30:01 -05:00

externalauthparam.go

chore: move /gitauth to /externalauth on the frontend (#9954)

2023-09-30 14:30:01 -05:00

groupparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

groupparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

hsts_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

hsts.go

chore: enable exhaustruct linter (#8403)

2023-07-11 14:30:33 +01:00

httpmw_internal_test.go

feat: add RFC 9728 OAuth2 resource metadata support (#18920)

2025-07-19 22:05:15 +02:00

httpmw.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

notificationtemplateparam.go

feat: add notification preferences database & audit support (#14100)

2024-08-05 16:18:45 +02:00

oauth2_test.go

chore: add custom samesite options to auth cookies (#16885)

2025-04-08 14:15:14 -05:00

oauth2.go

fix: return 404 instead of 401 for missing OAuth2 apps (#18755)

2025-07-07 19:57:32 +02:00

organizationparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

organizationparam.go

feat(coderd): add ability to search org members by user_id, is_system, github_user_id (#20048)

2025-09-30 23:54:21 +01:00

pprof.go

chore: rename service -> coder_service, remove agent_id label (#19241)

2025-08-07 13:58:39 -05:00

prometheus_test.go

chore: add missing prometheus tests for UNKNOWN/STATIC paths (#17446)

2025-04-17 13:50:18 +02:00

prometheus.go

feat: add path & method labels to prometheus metrics for current requests (#17362)

2025-04-16 11:10:39 +02:00

provisionerdaemon.go

chore: improve testing coverage on ExtractProvisionerDaemonAuthenticated middleware (#15622)

2024-11-26 04:02:20 +01:00

provisionerkey.go

chore: add provisioner key crud apis (#13857)

2024-07-16 13:27:12 -04:00

ratelimit_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

ratelimit.go

chore: ensure proper rbac permissions on 'Acquire' file in the cache (#18348)

2025-06-16 13:40:45 +00:00

realip_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

realip.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

requestid_test.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

requestid.go

feat: add request_id to HTTP trace spans (#10145)

2023-10-09 14:05:10 -05:00

rfc6750_extended_test.go

fix: trim whitespace from API tokens (#19814)

2025-09-15 10:02:10 +02:00

rfc6750_test.go

fix: trim whitespace from API tokens (#19814)

2025-09-15 10:02:10 +02:00

taskparam_test.go

feat(coderd): add lookup task by name in httpmw.TaskParam (#20647)

2025-11-05 14:28:34 +00:00

taskparam.go

feat(coderd): add lookup task by name in httpmw.TaskParam (#20647)

2025-11-05 14:28:34 +00:00

templateparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

templateparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

templateversionparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

templateversionparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

userparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

userparam.go

feat: remove site wide perms from creating a workspace (#17296)

2025-04-09 14:35:43 -05:00

workspaceagent_test.go

chore: join owner, template, and org in new workspace view (#15116)

2024-10-22 09:20:54 -05:00

workspaceagent.go

refactor: use task data model for notifications (#20590)

2025-10-31 15:53:27 +02:00

workspaceagentparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

workspaceagentparam.go

feat: extend request logs with auth & DB info (#17304)

2025-04-15 13:27:23 +02:00

workspacebuildparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

workspacebuildparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

workspaceparam_test.go

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

workspaceparam.go

feat: extend request logs with auth & DB info (#17304)

2025-04-15 13:27:23 +02:00

workspaceproxy_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

workspaceproxy.go

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

workspaceresourceparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

workspaceresourceparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00