Authentication Proxy #7741

anochj · 2026-04-04T01:32:06Z

anochj
Apr 4, 2026

Hi,

I'm trying to deploy code-server as a ECS task, but want to keep it private. I'm thinking of making a proxy that checks for a token/auth header. I've been trying to do this Hono, but I can't find any related articles for this.

Do you have any ideas or approaches for how I would do this?

Thanks!!

code-asher · 2026-04-06T19:13:26Z

code-asher
Apr 6, 2026
Maintainer

If you want to auth with a header, one idea is to set the cookie header and auth using code-server's built-in auth (basically treating the password like a static token).

One combination I like is oauth2-proxy with Pocket ID, for passkey-based auth. There is probably a way to set up oauth2-proxy to auth with a header.

0 replies

itxashancode · 2026-04-12T15:53:06Z

itxashancode
Apr 12, 2026

I’d skip writing a custom Hono handler and just let code‑server run with --auth none behind a thin reverse‑proxy that does the token check. I’ve used Nginx for this on ECS and it’s only a few lines.

Build the code‑server image with ENV PASSWORD= (or omit it) and start it with code-server --bind-addr 0.0.0.0:8080 --auth none.
In the same task definition add a side‑car container running the official nginx:alpine image.
Mount a small config into /etc/nginx/conf.d/default.conf:

server {
 listen 80;
 location / {
 # expect a header X-Auth-Token: <secret>
 if ($http_x_auth_token != "s3cr3t‑token") {
 return 401;
 }
 proxy_pass http://localhost:8080;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 }
}

6 replies

itxashancode Apr 18, 2026

The WebSocket 1006 issue on recent code server versions behind nginx and is a known pain point.
The fix might be is to make sure nginx properly handles the WebSocket upgrade, older versions were more lenient about it.
This might Fix

nginxproxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;

Your current config sets Connection upgrade (missing the quotes), which is why it breaks on newer code server. The string needs to be "upgrade" literally, not the variable.
Also worth checking that newer linuxserver/code server images use port 8080 not 8443 by default, confirm what port the container actually exposes, or you'll get a silent proxy failure that also looks like a WS error.

anochj Apr 19, 2026
Author

Unfortunately, I'm still getting the same error.

itxashancode Apr 19, 2026

Well I am sry I can't help more on this issue.
A Follow would be rlly Nice tho :3

code-asher Apr 20, 2026
Maintainer

The only thing that stands out to me is that you might want proxy_set_header Host $http_host; instead of just $host, because of #6166

If that does not help, try enabling debug logging since it might give you some info on why the websocket connection is failing.

itxashancode Apr 20, 2026

Okki Thanks :3

Navigation Menu

Repository navigation

Authentication Proxy #7741

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 6 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Authentication Proxy #7741

Uh oh!

anochj Apr 4, 2026

Replies: 2 comments · 6 replies

Uh oh!

code-asher Apr 6, 2026 Maintainer

Uh oh!

itxashancode Apr 12, 2026

Uh oh!

itxashancode Apr 18, 2026

Uh oh!

anochj Apr 19, 2026 Author

Uh oh!

itxashancode Apr 19, 2026

Uh oh!

code-asher Apr 20, 2026 Maintainer

Uh oh!

itxashancode Apr 20, 2026

anochj
Apr 4, 2026

Replies: 2 comments 6 replies

code-asher
Apr 6, 2026
Maintainer

itxashancode
Apr 12, 2026

anochj Apr 19, 2026
Author

code-asher Apr 20, 2026
Maintainer