Previews and shells on a server

On a laptop, the browser reaches each sandbox directly on 127.0.0.1. On a server, sandboxes still listen only on 127.0.0.1, and Caddy serves them at public HTTPS addresses:

Turn this on by setting SANDBOX_GATEWAY_DOMAIN to your domain. The install script does this for you.

How each request is checked

• The app’s login cookie stays on the app’s own host. Code in a sandbox never sees it, and a sandboxed app’s own cookies (a Laravel app’s laravel-session, say) can’t clash with it
• The workspace opens previews and shells through /projects/<id>/open/<kind>, which hands the browser a short-lived token for that one address. The address trades it for its own zap_gateway cookie, valid for 12 hours
• Laravel checks that cookie and only allows users who can see the project
• Caddy strips any X-Zap-Upstream header sent by the browser, so a client can’t choose where requests go
• Certificates are only issued for preview-<id> and shell-<id> hosts of sandboxes that exist
• The /sandbox-gateway/* endpoints are blocked on the public site; only Caddy calls them

Settings