mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-20 16:02:19 +00:00
Ruben Fiszel
ba5b3dca73
WIN-2006: render public apps (and raw apps) inside an iframe handed a
narrowly-scoped token by its embedder at startup, instead of relying on
the host-based public-app route whitelist. When PUBLIC_APP_DOMAIN is set
the iframe lives on a separate origin (hard XSS boundary); otherwise it
is same-origin and the scoped token constrains the app's own calls.
Backend:
- APP_EMBED_SCOPES + mint_app_embed_token helper (apps.rs)
- GET /apps_u/embed_token/{secret} (OSS) and
/apps_u/embed_token_by_custom_path/{custom_path} (EE) validate app
access then mint a 12h token scoped to exactly the endpoints an app
needs (apps:run, jobs:read, resources:read, users:read, folders:read)
- public_app_domain() getter exposing the configured domain
- unit test locking the allow/deny scope matrix
Frontend:
- PublicAppFrame.svelte: embedder (mint token, render iframe, postMessage
handshake, login on the main domain) + viewer (use only the token)
- wired into /public/{ws}/{secret} and /a/{custom_path}
See docs/app-iframe-isolation.md. EE companion:
windmill-ee-private#ruben/win-2006-...
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>