Skip to content

feat: default coder.useKeyring to true and harden shared credential handling #1107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
EhabY wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat: default coder.useKeyring to true and harden shared credential handling #1107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d38afa2
feat: default coder.useKeyring to true and harden shared credential h…
EhabY Sep 10, 2026
5000734
fix: scope CLI credential reads to https and CLI 2.32
EhabY Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,34 @@
from published versions since it shows up in the VS Code extension changelog
tab and is confusing to users. Add it back between releases if needed. -->

## Unreleased

### Changed

- Store session tokens in the OS keyring by default on macOS and Windows. The

@code-asher code-asher Sep 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The wording to me makes it sound like the keyring is the only place they are stored now but we do still store them in VS Code's secret storage from what I can tell (looking at persistSessionAuth).

Could just be a me issue though lol. But maybe "Additionally store session tokens in the OS keyring by default for use by the cli...does not change how the plugin stores its own tokens" or something

entry is shared with the `coder` CLI, so signing in here also signs in the
CLI. Requires Coder CLI 2.29.0 or later; older CLIs and Linux keep using a
file. To opt out, set `coder.useKeyring` to `false`.
- Pass `coder.useKeyring` to the CLI as `--use-keyring`, so the setting wins
over the `CODER_USE_KEYRING` environment variable.
- Honor `CODER_CONFIG_DIR` like `--global-config` in `coder.globalFlags`.
- Read the `coder` CLI's session only on Coder CLI 2.32.0 or later, up from
2.31.0, where the CLI checks the stored URL against the one you connect to.
- Ask before signing in with the `coder` CLI's session when it belongs to a
different user than your previous session.
- Show an error with **Open Settings** when the CLI cannot store the token at
login, and a **Show Output** button when logout cannot remove every
credential.

### Security

- Sign out the `coder` CLI only when it still holds the token this extension
created. A session that came from the CLI is removed from the extension
without signing the CLI out.
- Read the CLI's keyring entry only for `https` deployments. The entry is keyed
by host, so an `http` address for the same host would receive the `https`
session's token.

## [v1.16.2](https://github.com/coder/vscode-coder/releases/tag/v1.16.2) 2026-08-25

### Fixed
Expand Down
6 changes: 3 additions & 3 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,7 @@
"ignoreSync": true
},
"coder.globalFlags": {
"markdownDescription": "Global flags to pass to every Coder CLI invocation. Enter each flag as a separate array item, in order. Do **not** include the `coder` command itself. See the [CLI reference](https://coder.com/docs/reference/cli) for available global flags.\n\nSupports `${env:VAR}`, `${userHome}`, and a leading `~`. For `--flag=value` items the expansion applies to the value half, so `--cfg=~/coder` works.\n\nSet `--global-config` here to point the CLI at a shared config directory (e.g. `--global-config=~/.config/coderv2` to share login/auth with the Coder CLI); requires a deployment on 2.31.0+ and is ignored when `#coder.useKeyring#` is active. The `--use-keyring` flag is ignored; use `#coder.useKeyring#` instead.\n\nFor `--header-command`, precedence is: `#coder.headerCommand#` setting, then `CODER_HEADER_COMMAND` environment variable, then the value specified here.",
"markdownDescription": "Global flags to pass to every Coder CLI invocation. Enter each flag as a separate array item, in order. Do **not** include the `coder` command itself. See the [CLI reference](https://coder.com/docs/reference/cli) for available global flags.\n\nSupports `${env:VAR}`, `${userHome}`, and a leading `~`. For `--flag=value` items the expansion applies to the value half, so `--cfg=~/coder` works.\n\nTo share a config directory with the `coder` CLI, add `--global-config` here (for example `--global-config=~/.config/coderv2`) or set `CODER_CONFIG_DIR`. Requires Coder CLI 2.32.0 or later. A `--use-keyring` item is ignored; use `#coder.useKeyring#` instead.\n\nFor `--header-command`, precedence is: `#coder.headerCommand#` setting, then `CODER_HEADER_COMMAND` environment variable, then the value specified here.",
"type": "array",
"items": {
"type": "string"
Expand All @@ -204,9 +204,9 @@
"ignoreSync": true
},
"coder.useKeyring": {
"markdownDescription": "Store session tokens in the OS keyring (macOS Keychain, Windows Credential Manager) instead of plaintext files. Requires CLI >= 2.29.0 (>= 2.31.0 to sync login from CLI to VS Code). This will attempt to sync between the CLI and VS Code since they share the same keyring entry. It will log you out of the CLI if you log out of the IDE, and vice versa. Has no effect on Linux.",
"markdownDescription": "Store session tokens in the OS keyring (macOS Keychain, Windows Credential Manager) instead of a file. Requires Coder CLI 2.29.0 or later; 2.32.0 or later to sign in with the CLI's existing session. Has no effect on Linux.\n\nThe keyring entry is shared with the `coder` CLI: signing in here also signs in the CLI, and signing out signs out the CLI only when it still holds the token this extension created.",
"type": "boolean",
"default": false,
"default": true,
"scope": "application"
},
"coder.networkThreshold.latencyMs": {
Expand Down
25 changes: 19 additions & 6 deletions src/commands.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -708,12 +708,25 @@ export class Commands {
await this.deploymentManager.clearDeployment("logout");

if (deployment) {
const cleared = await this.cliManager.clearCredentials(deployment.url);
const session = await this.secretsManager.getSessionAuth(
deployment.safeHostname,
);
const cleared = await this.cliManager.clearCredentials(
deployment.url,
session,
);
await this.secretsManager.clearAllAuthData(deployment.safeHostname);
if (!cleared) {
vscode.window.showWarningMessage(
'You\'ve been logged out of Coder, but some credentials could not be removed. Log out again to retry, or run "coder logout" in a terminal.',
);
vscode.window
.showWarningMessage(
'You\'ve been logged out of Coder, but some credentials could not be removed. Log out again to retry, or run "coder logout" in a terminal.',
"Show Output",
)
.then((action) => {
if (action === "Show Output") {
this.logger.show();
}
});
return { success: false, reason: "cleanup_incomplete" };
}
}
Expand Down Expand Up @@ -790,7 +803,7 @@ export class Commands {
const selectedHostname = selected.hostnames[0];
const auth = await this.secretsManager.getSessionAuth(selectedHostname);
if (auth?.url) {
await this.cliManager.clearCredentials(auth.url);
await this.cliManager.clearCredentials(auth.url, auth);
}
await this.secretsManager.clearAllAuthData(selectedHostname);
this.logger.info("Removed credentials for", selectedHostname);
Expand All @@ -812,7 +825,7 @@ export class Commands {
selected.hostnames.map(async (h) => {
const auth = await this.secretsManager.getSessionAuth(h);
if (auth?.url) {
await this.cliManager.clearCredentials(auth.url);
await this.cliManager.clearCredentials(auth.url, auth);
}
await this.secretsManager.clearAllAuthData(h);
}),
Expand Down
Loading