Remotely disconnect Code-Server container connection to User

[metalshanked]

Hi,
I am trying to setup authentication using Nginx Ingress Annotations to forward requests to an external auth service.

However, when the external Auth service sends a 401 response , I would ideally like to have code-server "logout" or show the "reload" modal dialog to the user.

Example:-

Is there a "remote api" which can trigger this on the code-server instance? something like the healthz endpoint

Thanks!

[jsjoeio]

I don't think there is at the moment. We have talked about adding support for something like this (maybe through a plugin or an API). But @code-asher may correct me if that's wrong or if he knows of a workaround.

[metalshanked]

Oh ok, thanks for the info @jsjoeio. I am looking to make Nginx Ingress Auth Annotations work with the below two annotations

nginx.ingress.kubernetes.io/auth-url : https://external-auth-service.com
nginx.ingress.kubernetes.io/auth-signin: https://external-auth-service.com/login

It is almost working except for that when "https://external-auth-service.com" returns 401 for a failed auth attempt, the code-server UI does not seem to reflect any change to the end user (I think the websocket stays open even if the ingress is blocking http traffic to the code-server container) .
So was wondering if there was a way to remotely disconnect the websocket.

[jsjoeio]

So was wondering if there was a way to remotely disconnect the websocket.

Great question 🤔 I wish I knew the answer but I don't. @code-asher might though!

[code-asher]

Nope, there's no way to do this at the moment except maybe force code-server to restart by sending it a SIGUSR1 or have a proxy in between you can use to close the socket or something like that.

Maybe we should periodically check if the user is still authenticated and if not close the socket?