Permalink
Checking mergeability…
Don’t worry, you can still create the pull request.
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 5 commits
- 14 files changed
- 1 contributor
Commits on Sep 7, 2026
-
fix: require a token on the dev server API and validate Host
While `uipath dev` was running, any page the developer opened could read the project through the unauthenticated localhost API and take the UiPath Cloud access token out of `.env`, or write an entrypoint and trigger a run. The server now mints a random token per run. The console gets it in the URL it is opened with, `uipath-dev-mcp` reads it from `.uipath/dev-server.token` at mode 0600, and it is required as an `Authorization` header on `/api` and as a query parameter on `/ws`, which cannot carry headers. Requiring a header rather than a cookie also covers CSRF, because a cross-origin page cannot set one without a preflight. A `Host` allowlist rejects DNS rebinding, which would otherwise make an attacker's page same-origin and skip any cross-origin check. The frontend changes are load-bearing: with a token required the console answers 401 on every panel until it sends one. `static/` is rebuilt because it is committed build output and no workflow rebuilds it. CORS and the `.env` denylist are left alone; #110 covers both.
-
test: hand the e2e browser tests the tokened console URL
The web e2e tests navigated to a bare server URL, so with a token required the console loaded and then answered 401 on every API call, leaving no elements to assert on. The fixture now yields `console_url`, the same URL the server opens the browser with in production, and the new-run helper appends its fragment to a URL that already carries a query string.
-
fix: build the websocket URL per attempt and stop retrying a refusal
The console froze its websocket URL in the WsClient constructor, so a token that arrived after construction, or a fresh token minted by a server restart, could never reach a reconnect. A stale tab then retried every two seconds indefinitely, and the server logged a refused handshake each time. The URL is now built per attempt, and a 1008 close ends the retry loop and prints which URL to open, since a refused handshake cannot succeed on a retry.
-
fix: say which origin a refused websocket came from
"Refused an unauthenticated WebSocket handshake" gives a developer nothing to act on, and the two causes need different fixes: a page opened without the token, or a page still holding a token from an earlier server run. The message now names the origin and separates the two cases, and points at the URL printed at startup.
-
fix: stop the browser caching the console's entry document
StaticFiles served index.html with no cache headers, so a browser could reuse a cached document naming asset hashes a rebuild had already deleted. The tab then kept running code that was no longer served, which with a per-run token meant it could never authenticate and retried its websocket indefinitely. The hashed assets stay cacheable, since their names change; index.html is now no-store so a reload always picks up the assets currently on disk.
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff main...fix/dev-server-auth