feat: add certificate caching for AI Bridge Proxy #21344
+314
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Dec 19, 2025
Contributor
Author
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
Comment on lines
214
to
321
| targetServer := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| w.WriteHeader(http.StatusOK) | ||
| })) | ||
| defer targetServer.Close() | ||
|
|
||
| certFile, keyFile := generateTestCA(t) | ||
| logger := slogtest.Make(t, nil) | ||
|
|
||
| // Start the proxy server. | ||
| srv, err := aibridgeproxyd.New(t.Context(), logger, aibridgeproxyd.Options{ | ||
| ListenAddr: "127.0.0.1:0", | ||
| CoderAccessURL: "http://localhost:3000", | ||
| CertFile: certFile, | ||
| KeyFile: keyFile, | ||
| }) | ||
| require.NoError(t, err) | ||
| t.Cleanup(func() { _ = srv.Close() }) | ||
|
|
||
| proxyAddr := srv.Addr() | ||
| require.NotEmpty(t, proxyAddr) | ||
|
|
||
| // Wait for the proxy server to be ready. | ||
| require.Eventually(t, func() bool { | ||
| conn, err := net.Dial("tcp", proxyAddr) | ||
| if err != nil { | ||
| return false | ||
| } | ||
| _ = conn.Close() | ||
| return true | ||
| }, testutil.WaitShort, testutil.IntervalFast) | ||
|
|
||
| // Load the CA certificate so the client trusts the proxy's MITM certificate. | ||
| certPEM, err := os.ReadFile(certFile) | ||
| require.NoError(t, err) | ||
| certPool := x509.NewCertPool() | ||
| certPool.AppendCertsFromPEM(certPEM) | ||
|
|
||
| // Create an HTTP client configured to use the proxy. | ||
| proxyURL, err := url.Parse("http://" + proxyAddr) | ||
| require.NoError(t, err) | ||
|
|
||
| client := &http.Client{ | ||
| Transport: &http.Transport{ | ||
| Proxy: http.ProxyURL(proxyURL), | ||
| ProxyConnectHeader: http.Header{ | ||
| "Proxy-Authorization": []string{makeProxyAuthHeader("test-session-token")}, | ||
| }, | ||
| TLSClientConfig: &tls.Config{ | ||
| MinVersion: tls.VersionTLS12, | ||
| RootCAs: certPool, | ||
| }, | ||
| }, | ||
| } |
Contributor
There was a problem hiding this comment.
Nit: this feels like a repeated pattern that we could move into a test util to make the tests more readable.
Contributor
Author
There was a problem hiding this comment.
Aggree, I will address this in a follow-up PR 👍
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
from
9b2593b to
bc4caed
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-cert-caching
branch
2 times, most recently
from
ecf32ef to
330ccd7
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
from
bc4caed to
97198d5
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-cert-caching
branch
from
330ccd7 to
ee37009
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
2 times, most recently
from
7e117da to
6e0a054
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-cert-caching
branch
2 times, most recently
from
77155cc to
b0a0d5d
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
from
6b3a42f to
b82c306
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-cert-caching
branch
2 times, most recently
from
fd98405 to
42720ba
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
from
b82c306 to
5e6a35c
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-cert-caching
branch
2 times, most recently
from
dd18dfb to
01151fb
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
from
5a1d2dc to
4196397
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-cert-caching
branch
2 times, most recently
from
b22bf6c to
32e418d
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
from
4196397 to
64470eb
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-cert-caching
branch
from
32e418d to
bdf6895
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
from
64470eb to
dcda7da
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-cert-caching
branch
2 times, most recently
from
cd695b9 to
2cecfac
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
from
644e954 to
4654e31
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-cert-caching
branch
from
2cecfac to
ab0b3f6
Compare
ssncferreira
force-pushed
the
ssncferreira/feat-aiproxy-routing
branch
from
4654e31 to
e0906db
Compare
dannykopping
approved these changes
Dec 24, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Implements in-memory certificate caching for the AI Bridge MITM proxy. Certificate generation is expensive (RSA key generation + signing), so caching avoids repeated generation for the same hostname.
Changes
certCachestruct implementinggoproxy.CertStoragewith thread-safe double-check lockingproxy.CertStoreCloses coder/internal#1183