Jakub Domeracki 5f343bc337 fix(coderd): backport frame-ancestors CSP fixes to 2.32 (#24474, #24529) (#24806) ...

Cherry-pick backport of #24474 and #24529 to `release/2.32`.

- #24474: fix(coderd): add frame-ancestors CSP directive to prevent
clickjacking
- #24529: fix(coderd): omit frame-ancestors CSP for embed routes

Both commits cherry-picked cleanly with no conflicts.

> Generated by Coder Agents

2026-05-13 15:16:48 -04:00

..

loggermw

chore: extract testutil.FakeSink for slog test assertions (#23208)

2026-03-18 17:02:38 +00:00

patternmatcher

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

actor_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

actor.go

feat: implement provisioner auth middleware and proper org params (#12330)

2024-03-04 15:15:41 -06:00

apikey_test.go

fix(coderd/httpmw): return 500 for internal auth errors (#23352)

2026-03-24 12:37:17 +11:00

apikey.go

refactor: replace AsSystemRestricted with narrower actors (#23712)

2026-03-27 15:08:30 +00:00

authorize_test.go

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

authz_test.go

fix: exit reset password request before passwords are compared (#13856)

2024-07-09 14:28:39 -05:00

authz.go

chore: make authz recorder opt in (#20310)

2025-10-21 14:15:37 +00:00

chatparam_test.go

feat: provider key policies and user provider settings (#23751)

2026-04-02 19:46:42 +02:00

chatparam.go

feat: add experimental agents support (#22290)

2026-02-27 16:50:56 +00:00

clitelemetry.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

cors_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

cors.go

feat: add RFC 9728 OAuth2 resource metadata support (#18920)

2025-07-19 22:05:15 +02:00

csp_test.go

fix(coderd): backport frame-ancestors CSP fixes to 2.32 (#24474, #24529) (#24806)

2026-05-13 15:16:48 -04:00

csp.go

fix(coderd): backport frame-ancestors CSP fixes to 2.32 (#24474, #24529) (#24806)

2026-05-13 15:16:48 -04:00

csrf_test.go

fix(coderd): harden OAuth2 provider security (#22194)

2026-02-23 12:18:44 +01:00

csrf.go

chore: clean up stale and dangerous //nolint comments (#23643)

2026-03-26 14:13:53 +00:00

experiments.go

feat: add MCP HTTP server experiment and improve experiment middleware (#18712)

2025-07-03 20:09:18 +02:00

externalauthparam_test.go

chore: move /gitauth to /externalauth on the frontend (#9954)

2023-09-30 14:30:01 -05:00

externalauthparam.go

chore: move /gitauth to /externalauth on the frontend (#9954)

2023-09-30 14:30:01 -05:00

groupparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

groupparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

hsts_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

hsts.go

chore: enable exhaustruct linter (#8403)

2023-07-11 14:30:33 +01:00

httpmw_internal_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

httpmw.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

httproute_test.go

chore(coderd/httpmw): extract HTTPRoute middleware (#21498)

2026-01-15 10:26:50 +00:00

httproute.go

chore(coderd/httpmw): extract HTTPRoute middleware (#21498)

2026-01-15 10:26:50 +00:00

notificationtemplateparam.go

feat: add notification preferences database & audit support (#14100)

2024-08-05 16:18:45 +02:00

oauth2_test.go

feat!: support PKCE in the oauth2 client's auth/exchange flow (#21215)

2025-12-15 17:41:47 +00:00

oauth2.go

fix(coderd/oauth2provider): support client_secret_basic client auth (#21793)

2026-02-02 16:01:33 +01:00

organizationparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

organizationparam.go

feat(coderd): add ability to search org members by user_id, is_system, github_user_id (#20048)

2025-09-30 23:54:21 +01:00

pprof.go

chore: rename service -> coder_service, remove agent_id label (#19241)

2025-08-07 13:58:39 -05:00

prometheus_test.go

chore(coderd/httpmw): extract HTTPRoute middleware (#21498)

2026-01-15 10:26:50 +00:00

prometheus.go

chore(coderd/httpmw): extract HTTPRoute middleware (#21498)

2026-01-15 10:26:50 +00:00

provisionerdaemon.go

chore: improve testing coverage on ExtractProvisionerDaemonAuthenticated middleware (#15622)

2024-11-26 04:02:20 +01:00

provisionerkey.go

chore: add provisioner key crud apis (#13857)

2024-07-16 13:27:12 -04:00

ratelimit_test.go

feat(coderd): add overload protection with rate limiting and concurrency control (#21161)

2025-12-11 16:38:54 +01:00

ratelimit.go

fix: rate limit by user instead of IP for authenticated requests (#22049)

2026-03-09 13:54:31 +01:00

realip_test.go

chore: remove unnecessary redeclarations in for loops (#18440)

2025-06-20 13:16:55 -06:00

realip.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

requestid_test.go

feat: add experimental agents support (#22290)

2026-02-27 16:50:56 +00:00

requestid.go

feat: add experimental agents support (#22290)

2026-02-27 16:50:56 +00:00

rfc6750_extended_test.go

fix: trim whitespace from API tokens (#19814)

2025-09-15 10:02:10 +02:00

rfc6750_test.go

fix: trim whitespace from API tokens (#19814)

2025-09-15 10:02:10 +02:00

taskparam_test.go

feat(coderd): add lookup task by name in httpmw.TaskParam (#20647)

2025-11-05 14:28:34 +00:00

taskparam.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

templateparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

templateparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

templateversionparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

templateversionparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

userparam_test.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

userparam.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

workspaceagent_test.go

fix(coderd): allow agent auth during workspace shutdown (#21538)

2026-01-21 13:18:43 +00:00

workspaceagent.go

fix(coderd): allow agent auth during workspace shutdown (#21538)

2026-01-21 13:18:43 +00:00

workspaceagentparam_test.go

perf: reduce number of queries made by /api/v2/workspaceagents/{id} (#21522)

2026-01-19 12:36:33 +00:00

workspaceagentparam.go

perf: reduce number of queries made by /api/v2/workspaceagents/{id} (#21522)

2026-01-19 12:36:33 +00:00

workspacebuildparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

workspacebuildparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00

workspaceparam_test.go

chore: remove unused ExtractWorkspaceAndAgentParam (#21537)

2026-01-16 15:11:10 +00:00

workspaceparam.go

chore: remove unused ExtractWorkspaceAndAgentParam (#21537)

2026-01-16 15:11:10 +00:00

workspaceproxy_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

workspaceproxy.go

chore!: ensure consistent secret token generation and hashing (#20388)

2025-10-23 15:38:49 -05:00

workspaceresourceparam_test.go

chore(coderd/httpmw): remove dbmem usage from tests (#18146)

2025-06-02 13:57:56 +02:00

workspaceresourceparam.go

chore: add /v2 to import module path (#9072)

2023-08-18 18:55:43 +00:00