@theia/core 1.74.0-next.47 → 1.74.0-next.51

package/lib/electron-node/hosting/electron-backend-hosting-module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"electron-backend-hosting-module.d.ts","sourceRoot":"","sources":["../../../src/electron-node/hosting/electron-backend-hosting-module.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;;AAI5C,wBAGG"}
+{"version":3,"file":"electron-backend-hosting-module.d.ts","sourceRoot":"","sources":["../../../src/electron-node/hosting/electron-backend-hosting-module.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;;AAK5C,wBAUG"}

package/lib/electron-node/hosting/electron-backend-hosting-module.js

@@ -17,9 +17,16 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const inversify_1 = require("inversify");
 const ws_request_validators_1 = require("../../node/ws-request-validators");
+const browser_connection_token_1 = require("../../node/hosting/browser-connection-token");
 const electron_ws_origin_validator_1 = require("./electron-ws-origin-validator");
 exports.default = new inversify_1.ContainerModule(bind => {
     bind(electron_ws_origin_validator_1.ElectronWsOriginValidator).toSelf().inSingletonScope();
     bind(ws_request_validators_1.WsRequestValidatorContribution).toService(electron_ws_origin_validator_1.ElectronWsOriginValidator);
+    // Electron uses its own `ElectronSecurityToken`, so the connection-token cookie is not used.
+    // Bind a no-op validator so consumers can inject it uniformly.
+    const noopValidator = {
+        validateRequest: (_req, _res, next) => next()
+    };
+    bind(browser_connection_token_1.HttpConnectionValidator).toConstantValue(noopValidator);
 });
 //# sourceMappingURL=electron-backend-hosting-module.js.map

package/lib/electron-node/hosting/electron-backend-hosting-module.js.map

@@ -1 +1 @@
-{"version":3,"file":"electron-backend-hosting-module.js","sourceRoot":"","sources":["../../../src/electron-node/hosting/electron-backend-hosting-module.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,yCAA4C;AAC5C,4EAAkF;AAClF,iFAA2E;AAE3E,kBAAe,IAAI,2BAAe,CAAC,IAAI,CAAC,EAAE;IACtC,IAAI,CAAC,wDAAyB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC5D,IAAI,CAAC,sDAA8B,CAAC,CAAC,SAAS,CAAC,wDAAyB,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC"}
+{"version":3,"file":"electron-backend-hosting-module.js","sourceRoot":"","sources":["../../../src/electron-node/hosting/electron-backend-hosting-module.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,yCAA4C;AAC5C,4EAAkF;AAClF,0FAAsF;AACtF,iFAA2E;AAE3E,kBAAe,IAAI,2BAAe,CAAC,IAAI,CAAC,EAAE;IACtC,IAAI,CAAC,wDAAyB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC5D,IAAI,CAAC,sDAA8B,CAAC,CAAC,SAAS,CAAC,wDAAyB,CAAC,CAAC;IAE1E,6FAA6F;IAC7F,+DAA+D;IAC/D,MAAM,aAAa,GAA4B;QAC3C,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;KAChD,CAAC;IACF,IAAI,CAAC,kDAAuB,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC"}

package/lib/electron-node/hosting/electron-backend-hosting-module.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=electron-backend-hosting-module.spec.d.ts.map

package/lib/electron-node/hosting/electron-backend-hosting-module.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"electron-backend-hosting-module.spec.d.ts","sourceRoot":"","sources":["../../../src/electron-node/hosting/electron-backend-hosting-module.spec.ts"],"names":[],"mappings":""}

package/lib/electron-node/hosting/electron-backend-hosting-module.spec.js

@@ -0,0 +1,39 @@
+"use strict";
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const inversify_1 = require("inversify");
+const electron_backend_hosting_module_1 = require("./electron-backend-hosting-module");
+const browser_connection_token_1 = require("../../node/hosting/browser-connection-token");
+describe('electron-backend-hosting-module', () => {
+    it('should bind a no-op HttpConnectionValidator that calls next() unconditionally', () => {
+        const container = new inversify_1.Container();
+        container.load(electron_backend_hosting_module_1.default);
+        const validator = container.get(browser_connection_token_1.HttpConnectionValidator);
+        let nextCalled = false;
+        let sentStatus;
+        // No cookie provided: the no-op validator must still call next() and never send a status.
+        const req = { headers: {} };
+        const res = { sendStatus: (status) => { sentStatus = status; } };
+        const next = () => { nextCalled = true; };
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        validator.validateRequest(req, res, next);
+        (0, chai_1.expect)(nextCalled).to.be.true;
+        (0, chai_1.expect)(sentStatus).to.be.undefined;
+    });
+});
+//# sourceMappingURL=electron-backend-hosting-module.spec.js.map

package/lib/electron-node/hosting/electron-backend-hosting-module.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"electron-backend-hosting-module.spec.js","sourceRoot":"","sources":["../../../src/electron-node/hosting/electron-backend-hosting-module.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAC9B,yCAAsC;AACtC,uFAA6E;AAC7E,0FAAsF;AAEtF,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAE7C,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACrF,MAAM,SAAS,GAAG,IAAI,qBAAS,EAAE,CAAC;QAClC,SAAS,CAAC,IAAI,CAAC,yCAA4B,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAA0B,kDAAuB,CAAC,CAAC;QAElF,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,UAA8B,CAAC;QACnC,0FAA0F;QAC1F,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,EAAwC,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEhD,8DAA8D;QAC9D,SAAS,CAAC,eAAe,CAAC,GAAU,EAAE,GAAU,EAAE,IAAW,CAAC,CAAC;QAE/D,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC9B,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;IACvC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/lib/node/hosting/backend-hosting-module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-hosting-module.d.ts","sourceRoot":"","sources":["../../../src/node/hosting/backend-hosting-module.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;;AAS5C,wBAUG"}
+{"version":3,"file":"backend-hosting-module.d.ts","sourceRoot":"","sources":["../../../src/node/hosting/backend-hosting-module.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;;AAS5C,wBAaG"}

package/lib/node/hosting/backend-hosting-module.js

@@ -25,10 +25,13 @@ exports.default = new inversify_1.ContainerModule(bind => {
     bind(backend_application_hosts_1.BackendApplicationHosts).toSelf().inSingletonScope();
     bind(ws_origin_validator_1.WsOriginValidator).toSelf().inSingletonScope();
     bind(ws_request_validators_1.WsRequestValidatorContribution).toService(ws_origin_validator_1.WsOriginValidator);
-    // Cookie-based connection token protects both HTTP and WebSocket endpoints.
+    // Cookie-based connection token. It is validated on WebSocket upgrades and bootstrapped
+    // (set as a cookie) on every HTTP request; HTTP enforcement is opt-in per route via
+    // `HttpConnectionValidator`.
     bind(browser_connection_token_1.BrowserConnectionToken).toConstantValue((0, browser_connection_token_1.createBrowserConnectionToken)());
     bind(browser_connection_token_1.BrowserConnectionTokenBackendContribution).toSelf().inSingletonScope();
     bind(backend_application_1.BackendApplicationContribution).toService(browser_connection_token_1.BrowserConnectionTokenBackendContribution);
     bind(ws_request_validators_1.WsRequestValidatorContribution).toService(browser_connection_token_1.BrowserConnectionTokenBackendContribution);
+    bind(browser_connection_token_1.HttpConnectionValidator).toService(browser_connection_token_1.BrowserConnectionTokenBackendContribution);
 });
 //# sourceMappingURL=backend-hosting-module.js.map

package/lib/node/hosting/backend-hosting-module.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-hosting-module.js","sourceRoot":"","sources":["../../../src/node/hosting/backend-hosting-module.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,yCAA4C;AAC5C,gEAAwE;AACxE,oEAA0E;AAC1E,2EAAsE;AACtE,yEAEoC;AACpC,+DAA0D;AAE1D,kBAAe,IAAI,2BAAe,CAAC,IAAI,CAAC,EAAE;IACtC,IAAI,CAAC,mDAAuB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC1D,IAAI,CAAC,uCAAiB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACpD,IAAI,CAAC,sDAA8B,CAAC,CAAC,SAAS,CAAC,uCAAiB,CAAC,CAAC;IAElE,4EAA4E;IAC5E,IAAI,CAAC,iDAAsB,CAAC,CAAC,eAAe,CAAC,IAAA,uDAA4B,GAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,oEAAyC,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC5E,IAAI,CAAC,oDAA8B,CAAC,CAAC,SAAS,CAAC,oEAAyC,CAAC,CAAC;IAC1F,IAAI,CAAC,sDAA8B,CAAC,CAAC,SAAS,CAAC,oEAAyC,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC"}
+{"version":3,"file":"backend-hosting-module.js","sourceRoot":"","sources":["../../../src/node/hosting/backend-hosting-module.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,yCAA4C;AAC5C,gEAAwE;AACxE,oEAA0E;AAC1E,2EAAsE;AACtE,yEAEoC;AACpC,+DAA0D;AAE1D,kBAAe,IAAI,2BAAe,CAAC,IAAI,CAAC,EAAE;IACtC,IAAI,CAAC,mDAAuB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC1D,IAAI,CAAC,uCAAiB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACpD,IAAI,CAAC,sDAA8B,CAAC,CAAC,SAAS,CAAC,uCAAiB,CAAC,CAAC;IAElE,wFAAwF;IACxF,oFAAoF;IACpF,6BAA6B;IAC7B,IAAI,CAAC,iDAAsB,CAAC,CAAC,eAAe,CAAC,IAAA,uDAA4B,GAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,oEAAyC,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC5E,IAAI,CAAC,oDAA8B,CAAC,CAAC,SAAS,CAAC,oEAAyC,CAAC,CAAC;IAC1F,IAAI,CAAC,sDAA8B,CAAC,CAAC,SAAS,CAAC,oEAAyC,CAAC,CAAC;IAC1F,IAAI,CAAC,kDAAuB,CAAC,CAAC,SAAS,CAAC,oEAAyC,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC"}

package/lib/node/hosting/browser-connection-token.d.ts

@@ -8,6 +8,24 @@ export declare const BROWSER_TOKEN_COOKIE_NAME = "theia-connection-token";
 export interface BrowserConnectionToken {
     value: string;
 }
+export declare const HttpConnectionValidator: unique symbol;
+/**
+ * Express middleware provider that rejects HTTP requests lacking a valid connection token.
+ *
+ * The connection-token cookie is only *bootstrapped* globally (see
+ * {@link BrowserConnectionTokenBackendContribution}); enforcement is opt-in per route.
+ * Security-sensitive HTTP endpoints (e.g. the filesystem upload/download routes) should
+ * inject this and apply {@link validateRequest} as route middleware. Non-sensitive routes
+ * (the initial HTML page, static assets) must not use it, as they legitimately have no
+ * cookie yet on the very first page load.
+ */
+export interface HttpConnectionValidator {
+    /**
+     * Express middleware that calls `next()` when the request carries a valid connection-token
+     * cookie (or when running in Electron) and responds with `403` otherwise.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void;
+}
 /**
  * Validates WebSocket and HTTP requests using a cookie-based connection token.
  *
@@ -15,12 +33,17 @@ export interface BrowserConnectionToken {
  * as a `SameSite=Strict; HttpOnly` cookie on the first page load. Cross-origin pages
  * cannot obtain or send this cookie, so their requests are rejected.
  *
+ * The cookie is *bootstrapped* for every HTTP request (via {@link expressMiddleware}) so that
+ * browsers always receive it, but HTTP requests are only *rejected* on routes that opt in to
+ * enforcement via {@link validateRequest} (see {@link HttpConnectionValidator}). WebSocket
+ * upgrades are always validated (see {@link allowWsUpgrade}).
+ *
  * This complements the origin validator: non-browser callers that omit the Origin
  * header (e.g. Node.js scripts) still cannot reach the backend without the cookie.
  *
  * Skipped in Electron deployments (which use their own `ElectronSecurityToken`).
  */
-export declare class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution {
+export declare class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution, HttpConnectionValidator {
     protected readonly browserConnectionToken: BrowserConnectionToken;
     protected readonly earlyMiddleware: EarlyExpressMiddleware;
     /**
@@ -35,6 +58,11 @@ export declare class BrowserConnectionTokenBackendContribution implements Backen
      * cannot provide the `SameSite=Strict` cookie either, so they are rejected.
      */
     allowWsUpgrade(request: http.IncomingMessage): MaybePromise<boolean>;
+    /**
+     * Reject the request with `403` unless it carries a valid connection-token cookie.
+     * Always allows the request in Electron deployments, consistent with {@link allowWsUpgrade}.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void;
     protected expressMiddleware(req: express.Request, res: express.Response, next: express.NextFunction): void;
     protected getTokenFromCookie(req: http.IncomingMessage): string | undefined;
     protected isTokenValid(token: string): boolean;

package/lib/node/hosting/browser-connection-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-connection-token.d.ts","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,OAAO,GAAG,QAAQ,SAAS,CAAC,CAAC;AAGpC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,qBACa,yCAA0C,YAAW,8BAA8B,EAAE,8BAA8B;IAG5H,SAAS,CAAC,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IAGlE,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IAE3D;;;;OAIG;IACH,UAAU,IAAI,IAAI;IAOlB;;;;OAIG;IACH,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC;IAapE,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,IAAI;IAc1G,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,SAAS;IAQ3E,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAUjD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,sBAAsB,CAErE"}
+{"version":3,"file":"browser-connection-token.d.ts","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,OAAO,GAAG,QAAQ,SAAS,CAAC,CAAC;AAGpC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACpC;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAClG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,yCAA0C,YAAW,8BAA8B,EAAE,8BAA8B,EAAE,uBAAuB;IAGrJ,SAAS,CAAC,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IAGlE,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IAE3D;;;;OAIG;IACH,UAAU,IAAI,IAAI;IAOlB;;;;OAIG;IACH,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC;IAapE;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,IAAI;IAe9F,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,IAAI;IAc1G,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,SAAS;IAQ3E,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAUjD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,sBAAsB,CAErE"}

package/lib/node/hosting/browser-connection-token.js

@@ -15,7 +15,7 @@
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BrowserConnectionTokenBackendContribution = exports.BROWSER_TOKEN_COOKIE_NAME = exports.BrowserConnectionToken = void 0;
+exports.BrowserConnectionTokenBackendContribution = exports.HttpConnectionValidator = exports.BROWSER_TOKEN_COOKIE_NAME = exports.BrowserConnectionToken = void 0;
 exports.createBrowserConnectionToken = createBrowserConnectionToken;
 const tslib_1 = require("tslib");
 const cookie = require("cookie");
@@ -26,6 +26,7 @@ const backend_application_1 = require("../backend-application");
 const uuid_1 = require("../../common/uuid");
 exports.BrowserConnectionToken = Symbol('BrowserConnectionToken');
 exports.BROWSER_TOKEN_COOKIE_NAME = 'theia-connection-token';
+exports.HttpConnectionValidator = Symbol('HttpConnectionValidator');
 /**
  * Validates WebSocket and HTTP requests using a cookie-based connection token.
  *
@@ -33,6 +34,11 @@ exports.BROWSER_TOKEN_COOKIE_NAME = 'theia-connection-token';
  * as a `SameSite=Strict; HttpOnly` cookie on the first page load. Cross-origin pages
  * cannot obtain or send this cookie, so their requests are rejected.
  *
+ * The cookie is *bootstrapped* for every HTTP request (via {@link expressMiddleware}) so that
+ * browsers always receive it, but HTTP requests are only *rejected* on routes that opt in to
+ * enforcement via {@link validateRequest} (see {@link HttpConnectionValidator}). WebSocket
+ * upgrades are always validated (see {@link allowWsUpgrade}).
+ *
  * This complements the origin validator: non-browser callers that omit the Origin
  * header (e.g. Node.js scripts) still cannot reach the backend without the cookie.
  *
@@ -67,6 +73,24 @@ let BrowserConnectionTokenBackendContribution = class BrowserConnectionTokenBack
         // because it is set on the initial page load.
         return false;
     }
+    /**
+     * Reject the request with `403` unless it carries a valid connection-token cookie.
+     * Always allows the request in Electron deployments, consistent with {@link allowWsUpgrade}.
+     */
+    validateRequest(req, res, next) {
+        if (index_1.environment.electron.is()) {
+            next();
+            return;
+        }
+        const token = this.getTokenFromCookie(req);
+        if (token && this.isTokenValid(token)) {
+            next();
+            return;
+        }
+        // No cookie or stale/invalid token: reject. Legitimate browsers always have the cookie
+        // because it is set on the initial page load, and same-origin requests send it automatically.
+        res.sendStatus(403);
+    }
     expressMiddleware(req, res, next) {
         const existing = this.getTokenFromCookie(req);
         if (!existing || !this.isTokenValid(existing)) {

package/lib/node/hosting/browser-connection-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser-connection-token.js","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;AA6GhF,oEAEC;;AA7GD,iCAAiC;AACjC,iCAAiC;AAGjC,yCAA+C;AAC/C,8CAAiD;AAEjD,gEAAgG;AAEhG,4CAAiD;AAEpC,QAAA,sBAAsB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAE1D,QAAA,yBAAyB,GAAG,wBAAwB,CAAC;AAMlE;;;;;;;;;;;GAWG;AAEI,IAAM,yCAAyC,GAA/C,MAAM,yCAAyC;IAQlD;;;;OAIG;IACH,UAAU;QACN,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO;QACX,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACnG,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,OAA6B;QACxC,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,gEAAgE;QAChE,8CAA8C;QAC9C,OAAO,KAAK,CAAC;IACjB,CAAC;IAES,iBAAiB,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B;QAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,+DAA+D;YAC/D,GAAG,CAAC,MAAM,CAAC,iCAAyB,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE;gBACrE,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;aACZ,CAAC,CAAC;QACP,CAAC;QACD,IAAI,EAAE,CAAC;IACX,CAAC;IAES,kBAAkB,CAAC,GAAyB;QAClD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QACxC,IAAI,YAAY,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,iCAAyB,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAES,YAAY,CAAC,KAAa;QAChC,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AAtEY,8FAAyC;AAG/B;IADlB,IAAA,kBAAM,EAAC,8BAAsB,CAAC;;yFACmC;AAG/C;IADlB,IAAA,kBAAM,EAAC,4CAAsB,CAAC;sCACK,4CAAsB;kFAAC;oDANlD,yCAAyC;IADrD,IAAA,sBAAU,GAAE;GACA,yCAAyC,CAsErD;AAED;;GAEG;AACH,SAAgB,4BAA4B;IACxC,OAAO,EAAE,KAAK,EAAE,IAAA,mBAAY,GAAE,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"browser-connection-token.js","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;AAyJhF,oEAEC;;AAzJD,iCAAiC;AACjC,iCAAiC;AAGjC,yCAA+C;AAC/C,8CAAiD;AAEjD,gEAAgG;AAEhG,4CAAiD;AAEpC,QAAA,sBAAsB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAE1D,QAAA,yBAAyB,GAAG,wBAAwB,CAAC;AAMrD,QAAA,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAoBzE;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,yCAAyC,GAA/C,MAAM,yCAAyC;IAQlD;;;;OAIG;IACH,UAAU;QACN,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO;QACX,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACnG,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,OAA6B;QACxC,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,gEAAgE;QAChE,8CAA8C;QAC9C,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B;QACnF,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,uFAAuF;QACvF,8FAA8F;QAC9F,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAES,iBAAiB,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B;QAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,+DAA+D;YAC/D,GAAG,CAAC,MAAM,CAAC,iCAAyB,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE;gBACrE,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;aACZ,CAAC,CAAC;QACP,CAAC;QACD,IAAI,EAAE,CAAC;IACX,CAAC;IAES,kBAAkB,CAAC,GAAyB;QAClD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QACxC,IAAI,YAAY,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,iCAAyB,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAES,YAAY,CAAC,KAAa;QAChC,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AAzFY,8FAAyC;AAG/B;IADlB,IAAA,kBAAM,EAAC,8BAAsB,CAAC;;yFACmC;AAG/C;IADlB,IAAA,kBAAM,EAAC,4CAAsB,CAAC;sCACK,4CAAsB;kFAAC;oDANlD,yCAAyC;IADrD,IAAA,sBAAU,GAAE;GACA,yCAAyC,CAyFrD;AAED;;GAEG;AACH,SAAgB,4BAA4B;IACxC,OAAO,EAAE,KAAK,EAAE,IAAA,mBAAY,GAAE,EAAE,CAAC;AACrC,CAAC"}

package/lib/node/hosting/browser-connection-token.spec.js

@@ -16,6 +16,7 @@
 // *****************************************************************************
 Object.defineProperty(exports, "__esModule", { value: true });
 const chai_1 = require("chai");
+const common_1 = require("../../common");
 const browser_connection_token_1 = require("./browser-connection-token");
 describe('BrowserConnectionToken', () => {
     it('should generate unique tokens', () => {
@@ -124,5 +125,74 @@ describe('BrowserConnectionTokenBackendContribution', () => {
             (0, chai_1.expect)(result.cookieCalls[0].value).to.equal(token.value);
         });
     });
+    describe('validateRequest (HTTP token enforcement)', () => {
+        function callValidate(cookieValue) {
+            const contribution = createContribution();
+            const result = { nextCalled: false };
+            const req = { headers: {} };
+            if (cookieValue !== undefined) {
+                req.headers.cookie = `${browser_connection_token_1.BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+            }
+            const res = {
+                sendStatus: (status) => { result.sentStatus = status; }
+            };
+            const next = () => { result.nextCalled = true; };
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            contribution.validateRequest(req, res, next);
+            return result;
+        }
+        it('should allow request with valid token cookie', () => {
+            const result = callValidate(token.value);
+            (0, chai_1.expect)(result.nextCalled).to.be.true;
+            (0, chai_1.expect)(result.sentStatus).to.be.undefined;
+        });
+        it('should reject request with no cookie', () => {
+            const result = callValidate();
+            (0, chai_1.expect)(result.nextCalled).to.be.false;
+            (0, chai_1.expect)(result.sentStatus).to.equal(403);
+        });
+        it('should reject request with invalid token', () => {
+            const result = callValidate('wrong-token');
+            (0, chai_1.expect)(result.nextCalled).to.be.false;
+            (0, chai_1.expect)(result.sentStatus).to.equal(403);
+        });
+        it('should reject request with stale token from previous server', () => {
+            const staleToken = (0, browser_connection_token_1.createBrowserConnectionToken)().value;
+            const result = callValidate(staleToken);
+            (0, chai_1.expect)(result.nextCalled).to.be.false;
+            (0, chai_1.expect)(result.sentStatus).to.equal(403);
+        });
+        it('should reject request with empty token', () => {
+            const result = callValidate('');
+            (0, chai_1.expect)(result.nextCalled).to.be.false;
+            (0, chai_1.expect)(result.sentStatus).to.equal(403);
+        });
+    });
+    describe('Electron deployment (no-op)', () => {
+        let originalIsElectron;
+        beforeEach(() => {
+            originalIsElectron = common_1.environment.electron.is;
+            common_1.environment.electron.is = () => true;
+        });
+        afterEach(() => {
+            common_1.environment.electron.is = originalIsElectron;
+        });
+        it('validateRequest should call next() without a cookie', () => {
+            const contribution = createContribution();
+            let nextCalled = false;
+            let sentStatus;
+            const req = { headers: {} };
+            const res = { sendStatus: (status) => { sentStatus = status; } };
+            const next = () => { nextCalled = true; };
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            contribution.validateRequest(req, res, next);
+            (0, chai_1.expect)(nextCalled).to.be.true;
+            (0, chai_1.expect)(sentStatus).to.be.undefined;
+        });
+        it('allowWsUpgrade should return true without a cookie', () => {
+            const contribution = createContribution();
+            (0, chai_1.expect)(contribution.allowWsUpgrade(createRequest())).to.be.true;
+        });
+    });
 });
 //# sourceMappingURL=browser-connection-token.spec.js.map

package/lib/node/hosting/browser-connection-token.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser-connection-token.spec.js","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAE9B,yEAKoC;AAEpC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IAEpC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC9C,IAAA,aAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC7C,IAAA,aAAM,EAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAEvD,MAAM,KAAK,GAA2B,IAAA,uDAA4B,GAAE,CAAC;IAErE,SAAS,kBAAkB;QACvB,MAAM,YAAY,GAAG,IAAI,oEAAyC,EAAE,CAAC;QACrE,8DAA8D;QAC7D,YAAoB,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC;QACxD,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,SAAS,aAAa,CAAC,WAAoB;QACvC,MAAM,OAAO,GAAG;YACZ,OAAO,EAAE,EAA8B;SAClB,CAAC;QAC1B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAEnD,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACtD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YAClD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACrE,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAA,uDAA4B,GAAE,CAAC,KAAK,CAAC;YACxD,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE;oBACL,MAAM,EAAE,qBAAqB,oDAAyB,IAAI,KAAK,CAAC,KAAK,eAAe;iBAC3D;aACR,CAAC;YAC1B,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAalD,SAAS,cAAc,CAAC,WAAoB;YACxC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAiB,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YAEpE,MAAM,GAAG,GAAG;gBACR,OAAO,EAAE,EAAwC;gBACjD,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE;aACzC,CAAC;YACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;YACvE,CAAC;YAED,MAAM,GAAG,GAAG;gBACR,MAAM,EAAE,CAAC,IAAY,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;oBACtE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtD,CAAC;aACJ,CAAC;YAEF,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAEvD,8DAA8D;YAC7D,YAAoB,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YAClE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,oDAAyB,CAAC,CAAC;YACvE,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACjC,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,cAAc,CAAC,6BAA6B,CAAC,CAAC;YAC7D,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}
+{"version":3,"file":"browser-connection-token.spec.js","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAE9B,yCAA2C;AAC3C,yEAKoC;AAEpC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IAEpC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC9C,IAAA,aAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC7C,IAAA,aAAM,EAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAEvD,MAAM,KAAK,GAA2B,IAAA,uDAA4B,GAAE,CAAC;IAErE,SAAS,kBAAkB;QACvB,MAAM,YAAY,GAAG,IAAI,oEAAyC,EAAE,CAAC;QACrE,8DAA8D;QAC7D,YAAoB,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC;QACxD,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,SAAS,aAAa,CAAC,WAAoB;QACvC,MAAM,OAAO,GAAG;YACZ,OAAO,EAAE,EAA8B;SAClB,CAAC;QAC1B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAEnD,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACtD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YAClD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACrE,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAA,uDAA4B,GAAE,CAAC,KAAK,CAAC;YACxD,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE;oBACL,MAAM,EAAE,qBAAqB,oDAAyB,IAAI,KAAK,CAAC,KAAK,eAAe;iBAC3D;aACR,CAAC;YAC1B,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAalD,SAAS,cAAc,CAAC,WAAoB;YACxC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAiB,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YAEpE,MAAM,GAAG,GAAG;gBACR,OAAO,EAAE,EAAwC;gBACjD,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE;aACzC,CAAC;YACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;YACvE,CAAC;YAED,MAAM,GAAG,GAAG;gBACR,MAAM,EAAE,CAAC,IAAY,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;oBACtE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtD,CAAC;aACJ,CAAC;YAEF,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAEvD,8DAA8D;YAC7D,YAAoB,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YAClE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,oDAAyB,CAAC,CAAC;YACvE,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACjC,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,cAAc,CAAC,6BAA6B,CAAC,CAAC;YAC7D,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAOtD,SAAS,YAAY,CAAC,WAAoB;YACtC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAqB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YAEvD,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,EAAwC,EAAE,CAAC;YAClE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;YACvE,CAAC;YAED,MAAM,GAAG,GAAG;gBACR,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;aAClE,CAAC;YAEF,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAEvD,8DAA8D;YAC7D,YAAoB,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACpD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC5C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;YAC9B,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;YACtC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;YAC3C,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;YACtC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACnE,MAAM,UAAU,GAAG,IAAA,uDAA4B,GAAE,CAAC,KAAK,CAAC;YACxD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACxC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;YACtC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YAChC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;YACtC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;QAEzC,IAAI,kBAAiC,CAAC;QAEtC,UAAU,CAAC,GAAG,EAAE;YACZ,kBAAkB,GAAG,oBAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,oBAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,GAAG,EAAE;YACX,oBAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,kBAAkB,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC3D,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,UAA8B,CAAC;YACnC,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,EAAwC,EAAE,CAAC;YAClE,MAAM,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAChD,8DAA8D;YAC7D,YAAoB,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACtD,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YAC9B,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC1D,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/lib/node/index.d.ts

@@ -7,4 +7,5 @@ export * from './cli';
 export * from './setting-service';
 export { FileSystemLocking } from './filesystem-locking';
 export { BackendRequestAllowedContribution } from './request/backend-request-facade';
+export { HttpConnectionValidator } from './hosting/browser-connection-token';
 //# sourceMappingURL=index.d.ts.map

package/lib/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAgBA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAgBA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC"}

package/lib/node/index.js

@@ -15,7 +15,7 @@
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BackendRequestAllowedContribution = exports.FileSystemLocking = void 0;
+exports.HttpConnectionValidator = exports.BackendRequestAllowedContribution = exports.FileSystemLocking = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./backend-application"), exports);
 tslib_1.__exportStar(require("./backend-global"), exports);
@@ -28,4 +28,6 @@ var filesystem_locking_1 = require("./filesystem-locking");
 Object.defineProperty(exports, "FileSystemLocking", { enumerable: true, get: function () { return filesystem_locking_1.FileSystemLocking; } });
 var backend_request_facade_1 = require("./request/backend-request-facade");
 Object.defineProperty(exports, "BackendRequestAllowedContribution", { enumerable: true, get: function () { return backend_request_facade_1.BackendRequestAllowedContribution; } });
+var browser_connection_token_1 = require("./hosting/browser-connection-token");
+Object.defineProperty(exports, "HttpConnectionValidator", { enumerable: true, get: function () { return browser_connection_token_1.HttpConnectionValidator; } });
 //# sourceMappingURL=index.js.map

package/lib/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,gEAAsC;AACtC,2DAAiC;AACjC,kDAAwB;AACxB,6DAAmC;AACnC,sDAA4B;AAC5B,gDAAsB;AACtB,4DAAkC;AAClC,2DAAyD;AAAhD,uHAAA,iBAAiB,OAAA;AAC1B,2EAAqF;AAA5E,2IAAA,iCAAiC,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,gEAAsC;AACtC,2DAAiC;AACjC,kDAAwB;AACxB,6DAAmC;AACnC,sDAA4B;AAC5B,gDAAsB;AACtB,4DAAkC;AAClC,2DAAyD;AAAhD,uHAAA,iBAAiB,OAAA;AAC1B,2EAAqF;AAA5E,2IAAA,iCAAiC,OAAA;AAC1C,+EAA6E;AAApE,mIAAA,uBAAuB,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theia/core",
-  "version": "1.74.0-next.47+4054d107c",
+  "version": "1.74.0-next.51+bb9fc73ef",
   "description": "Theia is a cloud & desktop IDE framework implemented in TypeScript.",
   "main": "lib/common/index.js",
   "typings": "lib/common/index.d.ts",
@@ -17,8 +17,8 @@
     "@lumino/virtualdom": "^2.0.4",
     "@lumino/widgets": "2.7.5",
     "@parcel/watcher": "^2.5.6",
-    "@theia/application-package": "1.74.0-next.47+4054d107c",
-    "@theia/request": "1.74.0-next.47+4054d107c",
+    "@theia/application-package": "1.74.0-next.51+bb9fc73ef",
+    "@theia/request": "1.74.0-next.51+bb9fc73ef",
     "@types/body-parser": "^1.19.6",
     "@types/express": "^4.17.25",
     "@types/fs-extra": "^4.0.15",
@@ -230,5 +230,5 @@
   "nyc": {
     "extends": "../../configs/nyc.json"
   },
-  "gitHead": "4054d107c43b29999cffa353ec64cfef156cf714"
+  "gitHead": "bb9fc73ef01cc1add76946df2597681888f6199b"
 }

package/src/electron-node/hosting/electron-backend-hosting-module.spec.ts

@@ -0,0 +1,42 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import { Container } from 'inversify';
+import electronBackendHostingModule from './electron-backend-hosting-module';
+import { HttpConnectionValidator } from '../../node/hosting/browser-connection-token';
+
+describe('electron-backend-hosting-module', () => {
+
+    it('should bind a no-op HttpConnectionValidator that calls next() unconditionally', () => {
+        const container = new Container();
+        container.load(electronBackendHostingModule);
+        const validator = container.get<HttpConnectionValidator>(HttpConnectionValidator);
+
+        let nextCalled = false;
+        let sentStatus: number | undefined;
+        // No cookie provided: the no-op validator must still call next() and never send a status.
+        const req = { headers: {} as Record<string, string | undefined> };
+        const res = { sendStatus: (status: number) => { sentStatus = status; } };
+        const next = (): void => { nextCalled = true; };
+
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        validator.validateRequest(req as any, res as any, next as any);
+
+        expect(nextCalled).to.be.true;
+        expect(sentStatus).to.be.undefined;
+    });
+});

package/src/electron-node/hosting/electron-backend-hosting-module.ts

@@ -16,9 +16,17 @@
 
 import { ContainerModule } from 'inversify';
 import { WsRequestValidatorContribution } from '../../node/ws-request-validators';
+import { HttpConnectionValidator } from '../../node/hosting/browser-connection-token';
 import { ElectronWsOriginValidator } from './electron-ws-origin-validator';
 
 export default new ContainerModule(bind => {
     bind(ElectronWsOriginValidator).toSelf().inSingletonScope();
     bind(WsRequestValidatorContribution).toService(ElectronWsOriginValidator);
+
+    // Electron uses its own `ElectronSecurityToken`, so the connection-token cookie is not used.
+    // Bind a no-op validator so consumers can inject it uniformly.
+    const noopValidator: HttpConnectionValidator = {
+        validateRequest: (_req, _res, next) => next()
+    };
+    bind(HttpConnectionValidator).toConstantValue(noopValidator);
 });

package/src/node/hosting/backend-hosting-module.ts

@@ -19,7 +19,7 @@ import { BackendApplicationContribution } from '../backend-application';
 import { WsRequestValidatorContribution } from '../ws-request-validators';
 import { BackendApplicationHosts } from './backend-application-hosts';
 import {
-    BrowserConnectionToken, BrowserConnectionTokenBackendContribution, createBrowserConnectionToken
+    BrowserConnectionToken, BrowserConnectionTokenBackendContribution, HttpConnectionValidator, createBrowserConnectionToken
 } from './browser-connection-token';
 import { WsOriginValidator } from './ws-origin-validator';
 
@@ -28,9 +28,12 @@ export default new ContainerModule(bind => {
     bind(WsOriginValidator).toSelf().inSingletonScope();
     bind(WsRequestValidatorContribution).toService(WsOriginValidator);
 
-    // Cookie-based connection token protects both HTTP and WebSocket endpoints.
+    // Cookie-based connection token. It is validated on WebSocket upgrades and bootstrapped
+    // (set as a cookie) on every HTTP request; HTTP enforcement is opt-in per route via
+    // `HttpConnectionValidator`.
     bind(BrowserConnectionToken).toConstantValue(createBrowserConnectionToken());
     bind(BrowserConnectionTokenBackendContribution).toSelf().inSingletonScope();
     bind(BackendApplicationContribution).toService(BrowserConnectionTokenBackendContribution);
     bind(WsRequestValidatorContribution).toService(BrowserConnectionTokenBackendContribution);
+    bind(HttpConnectionValidator).toService(BrowserConnectionTokenBackendContribution);
 });

package/src/node/hosting/browser-connection-token.spec.ts

@@ -16,6 +16,7 @@
 
 import { expect } from 'chai';
 import * as http from 'http';
+import { environment } from '../../common';
 import {
     BrowserConnectionToken,
     BrowserConnectionTokenBackendContribution,
@@ -164,4 +165,95 @@ describe('BrowserConnectionTokenBackendContribution', () => {
             expect(result.cookieCalls[0].value).to.equal(token.value);
         });
     });
+
+    describe('validateRequest (HTTP token enforcement)', () => {
+
+        interface ValidationResult {
+            nextCalled: boolean;
+            sentStatus?: number;
+        }
+
+        function callValidate(cookieValue?: string): ValidationResult {
+            const contribution = createContribution();
+            const result: ValidationResult = { nextCalled: false };
+
+            const req = { headers: {} as Record<string, string | undefined> };
+            if (cookieValue !== undefined) {
+                req.headers.cookie = `${BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+            }
+
+            const res = {
+                sendStatus: (status: number) => { result.sentStatus = status; }
+            };
+
+            const next = (): void => { result.nextCalled = true; };
+
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (contribution as any).validateRequest(req, res, next);
+            return result;
+        }
+
+        it('should allow request with valid token cookie', () => {
+            const result = callValidate(token.value);
+            expect(result.nextCalled).to.be.true;
+            expect(result.sentStatus).to.be.undefined;
+        });
+
+        it('should reject request with no cookie', () => {
+            const result = callValidate();
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+
+        it('should reject request with invalid token', () => {
+            const result = callValidate('wrong-token');
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+
+        it('should reject request with stale token from previous server', () => {
+            const staleToken = createBrowserConnectionToken().value;
+            const result = callValidate(staleToken);
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+
+        it('should reject request with empty token', () => {
+            const result = callValidate('');
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+    });
+
+    describe('Electron deployment (no-op)', () => {
+
+        let originalIsElectron: () => boolean;
+
+        beforeEach(() => {
+            originalIsElectron = environment.electron.is;
+            environment.electron.is = () => true;
+        });
+
+        afterEach(() => {
+            environment.electron.is = originalIsElectron;
+        });
+
+        it('validateRequest should call next() without a cookie', () => {
+            const contribution = createContribution();
+            let nextCalled = false;
+            let sentStatus: number | undefined;
+            const req = { headers: {} as Record<string, string | undefined> };
+            const res = { sendStatus: (status: number) => { sentStatus = status; } };
+            const next = (): void => { nextCalled = true; };
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (contribution as any).validateRequest(req, res, next);
+            expect(nextCalled).to.be.true;
+            expect(sentStatus).to.be.undefined;
+        });
+
+        it('allowWsUpgrade should return true without a cookie', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest())).to.be.true;
+        });
+    });
 });

package/src/node/hosting/browser-connection-token.ts

@@ -33,6 +33,26 @@ export interface BrowserConnectionToken {
     value: string;
 }
 
+export const HttpConnectionValidator = Symbol('HttpConnectionValidator');
+
+/**
+ * Express middleware provider that rejects HTTP requests lacking a valid connection token.
+ *
+ * The connection-token cookie is only *bootstrapped* globally (see
+ * {@link BrowserConnectionTokenBackendContribution}); enforcement is opt-in per route.
+ * Security-sensitive HTTP endpoints (e.g. the filesystem upload/download routes) should
+ * inject this and apply {@link validateRequest} as route middleware. Non-sensitive routes
+ * (the initial HTML page, static assets) must not use it, as they legitimately have no
+ * cookie yet on the very first page load.
+ */
+export interface HttpConnectionValidator {
+    /**
+     * Express middleware that calls `next()` when the request carries a valid connection-token
+     * cookie (or when running in Electron) and responds with `403` otherwise.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void;
+}
+
 /**
  * Validates WebSocket and HTTP requests using a cookie-based connection token.
  *
@@ -40,13 +60,18 @@ export interface BrowserConnectionToken {
  * as a `SameSite=Strict; HttpOnly` cookie on the first page load. Cross-origin pages
  * cannot obtain or send this cookie, so their requests are rejected.
  *
+ * The cookie is *bootstrapped* for every HTTP request (via {@link expressMiddleware}) so that
+ * browsers always receive it, but HTTP requests are only *rejected* on routes that opt in to
+ * enforcement via {@link validateRequest} (see {@link HttpConnectionValidator}). WebSocket
+ * upgrades are always validated (see {@link allowWsUpgrade}).
+ *
  * This complements the origin validator: non-browser callers that omit the Origin
  * header (e.g. Node.js scripts) still cannot reach the backend without the cookie.
  *
  * Skipped in Electron deployments (which use their own `ElectronSecurityToken`).
  */
 @injectable()
-export class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution {
+export class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution, HttpConnectionValidator {
 
     @inject(BrowserConnectionToken)
     protected readonly browserConnectionToken: BrowserConnectionToken;
@@ -84,6 +109,25 @@ export class BrowserConnectionTokenBackendContribution implements BackendApplica
         return false;
     }
 
+    /**
+     * Reject the request with `403` unless it carries a valid connection-token cookie.
+     * Always allows the request in Electron deployments, consistent with {@link allowWsUpgrade}.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void {
+        if (environment.electron.is()) {
+            next();
+            return;
+        }
+        const token = this.getTokenFromCookie(req);
+        if (token && this.isTokenValid(token)) {
+            next();
+            return;
+        }
+        // No cookie or stale/invalid token: reject. Legitimate browsers always have the cookie
+        // because it is set on the initial page load, and same-origin requests send it automatically.
+        res.sendStatus(403);
+    }
+
     protected expressMiddleware(req: express.Request, res: express.Response, next: express.NextFunction): void {
         const existing = this.getTokenFromCookie(req);
         if (!existing || !this.isTokenValid(existing)) {

package/src/node/index.ts

@@ -23,3 +23,4 @@ export * from './cli';
 export * from './setting-service';
 export { FileSystemLocking } from './filesystem-locking';
 export { BackendRequestAllowedContribution } from './request/backend-request-facade';
+export { HttpConnectionValidator } from './hosting/browser-connection-token';