Skip to content

fix: Authenticate local devtools WebSocket#12738

Merged
anthonyshew merged 2 commits into
mainfrom
shew/auth-local-websocket
May 7, 2026
Merged

fix: Authenticate local devtools WebSocket#12738
anthonyshew merged 2 commits into
mainfrom
shew/auth-local-websocket

Conversation

@anthonyshew

@anthonyshew anthonyshew commented May 7, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Restrict new local devtools WebSocket upgrades to the expected devtools UI origin and a per-session token.
  • Pass the token through the browser URL fragment, then use it only for the localhost WebSocket connection.
  • Keep no-token docs URLs compatible with older unauthenticated local devtools servers.
  • Remove permissive CORS from the local devtools server.

Testing

  • cargo test -p turborepo-devtools
  • cargo check -p turborepo-lib
  • cargo fmt --check --package turborepo-devtools --package turborepo-lib
  • pnpm exec oxfmt --check
  • git diff --check origin/main...HEAD
  • pre-push hooks

Linear: TURBO-5522

@anthonyshew anthonyshew requested a review from a team as a code owner May 7, 2026 03:21
@anthonyshew anthonyshew requested review from tknickman and removed request for a team May 7, 2026 03:21
@vercel

vercel Bot commented May 7, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples-basic-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 3:27am
examples-designsystem-docs Ready Ready Preview, Comment, Open in v0 May 7, 2026 3:27am
examples-gatsby-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 3:27am
examples-kitchensink-blog Ready Ready Preview, Comment, Open in v0 May 7, 2026 3:27am
examples-nonmonorepo Ready Ready Preview, Comment, Open in v0 May 7, 2026 3:27am
examples-svelte-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 3:27am
examples-tailwind-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 3:27am
examples-vite-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 3:27am
turbo-site Ready Ready Preview, Comment, Open in v0 May 7, 2026 3:27am

@anthonyshew anthonyshew enabled auto-merge (squash) May 7, 2026 03:26
@anthonyshew anthonyshew merged commit 8276be8 into main May 7, 2026
56 checks passed
@anthonyshew anthonyshew deleted the shew/auth-local-websocket branch May 7, 2026 03:40
anthonyshew pushed a commit that referenced this pull request May 7, 2026
## Release v2.9.10

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/25509373774)

### Changes

- release(turborepo): 2.9.9-canary.4 (#12716) (`25c71b0`)
- release(turborepo): 2.9.9 (#12719) (`acfe475`)
- fix: Respect SCM env vars in `turbo query affected` (#12722)
(`3caa8fb`)
- ci: Package VSCode extension in release workflow (#12723) (`329a545`)
- fix: Avoid raw create-turbo example telemetry (#12725) (`ec0b8dd`)
- fix: Escape graph HTML payloads (#12726) (`89b4f4e`)
- fix: Prevent OTEL token injection to spoofed origins (#12727)
(`1fbc725`)
- fix: Retry HTTP status failures (#12728) (`e389d66`)
- fix: Validate microfrontend proxy Host header (#12730) (`eb46170`)
- fix: Redact task hash env debug logs (#12733) (`6d9fc06`)
- fix: Filter microfrontend proxy environments (#12732) (`9b28a75`)
- fix: Preserve FSEvents mount points for device-relative paths (#12729)
(`6ce73e0`)
- fix: Validate proxy Host headers (#12731) (`9f70395`)
- fix: Resolve TypeScript `.js` extension imports to `.ts` files in
boundaries (#12644) (`b47f6dc`)
- fix: Use random temp path for repo downloads (#12736) (`106698c`)
- release(turborepo): 2.9.10-canary.1 (#12734) (`b1001c1`)
- fix: Reject OTel endpoints with userinfo (#12737) (`a6efc3f`)
- fix: Authenticate local devtools WebSocket (#12738) (`8276be8`)
- fix: Handle clipboard exec errors (#12739) (`3305766`)
- fix: Restrict Vercel token reuse to trusted API origins (#12740)
(`18a3a22`)
- fix: Keep workspace config discovery inside root (#12741) (`86c0365`)
- fix: Hardening for daemon IPC endpoints (#12742) (`13a9a8b`)
- fix: Enforce cache filesystem boundaries (#12743) (`a50e863`)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
anthonyshew pushed a commit that referenced this pull request May 8, 2026
## Release v2.9.11-canary.1

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/25519302524)

### Changes

- fix: Use random temp path for repo downloads (#12736) (`106698c`)
- release(turborepo): 2.9.10-canary.1 (#12734) (`b1001c1`)
- fix: Reject OTel endpoints with userinfo (#12737) (`a6efc3f`)
- fix: Authenticate local devtools WebSocket (#12738) (`8276be8`)
- fix: Handle clipboard exec errors (#12739) (`3305766`)
- fix: Restrict Vercel token reuse to trusted API origins (#12740)
(`18a3a22`)
- fix: Keep workspace config discovery inside root (#12741) (`86c0365`)
- fix: Hardening for daemon IPC endpoints (#12742) (`13a9a8b`)
- fix: Enforce cache filesystem boundaries (#12743) (`a50e863`)
- release(turborepo): 2.9.10 (#12745) (`4b3e7cc`)
- ci: Publish VS Code extension on release (#12747) (`1293d22`)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant