feat(site)!: add consent prompt for auto-creation with prefilled parameters by kacpersaw · Pull Request #22011 · coder/coder

kacpersaw · 2026-02-09T14:44:20Z

Summary

Workspace created via mode=auto links now require explicit user confirmation before provisioning. A warning dialog shows all prefilled param.* values from the URL and blocks creation until the user clicks Confirm and Create. Clicking Cancel falls back to the standard form view.

Breaking behavior change

Links using mode=auto (e.g., "Open in Coder" buttons) will no longer silently create workspaces. Users will now see a consent dialog and must explicitly confirm before the workspace is provisioned. Any existing integrations or automation relying on mode=auto for seamless workspace creation will now require manual user interaction.

…eters

coder-tasks · 2026-02-09T15:07:15Z

Documentation Check

Updates Needed

docs/admin/templates/open-in-coder.md - Update section 4 (line 100-108, "Optional: pre-fill parameter values") to mention the new consent dialog that appears when using mode=auto with prefilled parameters. Users will see a warning dialog showing all param.* values and must click "Confirm and Create" before the workspace is created.

⚠️ No documentation changes found in this PR - still needs to be addressed
docs/admin/templates/extending-templates/parameters.md - Update "Create Autofill" section (lines 408-428) to document the security consent dialog that appears when URL param.* parameters are used with automatic workspace creation. The dialog warns users about running scripts from untrusted sources and displays all prefilled parameter values for review.

⚠️ No documentation changes found in this PR - still needs to be addressed

Context

This PR adds an important security feature: when a workspace creation link uses mode=auto with prefilled parameters, users now see a consent dialog before the workspace is automatically created. The dialog:

Shows a warning icon and "Warning: Automatic Workspace Creation" title
Warns that "Running scripts from untrusted sources can be dangerous"
Lists all prefilled parameter names and values in a scrollable code block
Requires explicit "Confirm and Create" action (or "Cancel" to fall back to form view)

This protects users from malicious workspace creation links that could execute arbitrary code via template parameters like dotfiles_uri or startup_script.

Latest update (2026-02-11): Added Storybook stories for the dialog component (including scenarios with many parameters and long values), updated E2E tests to handle the consent dialog flow, and addressed PR review feedback. The implementation is complete and tested, but documentation still needs to be updated.

Automated review via Coder Tasks

site/src/pages/CreateWorkspacePage/CreateWorkspacePage.tsx

jdomeracki-coder · 2026-02-09T15:40:06Z

Size of the dialog box should be set dynamically - currently it doesn't fit longer than usual params

jdomeracki-coder

Works as intended 🧪

site/src/pages/CreateWorkspacePage/AutoCreateConsentDialog.tsx

Co-authored-by: Jake Howell <jacob@coder.com>

jakehwll

Left my nits about how the <Dialog /> is formed, fine otherwise 🙂

coder-tasks · 2026-02-11T12:13:49Z

Documentation Check

Updates Needed

docs/admin/templates/open-in-coder.md - Document the new security consent dialog that appears when using mode=auto with prefilled parameters
- Explain that users must explicitly confirm workspace creation when parameters are prefilled via URL
- Show what information is displayed (all param.* values from the URL)
- Explain the security rationale (protecting against malicious URLs with untrusted configurations like dotfiles or startup scripts)
- Consider adding a screenshot of the consent dialog

Automated review via Coder Tasks

coder-tasks · 2026-02-11T12:51:25Z

Documentation Check

Updates Needed

docs/admin/templates/open-in-coder.md - Document the new security consent dialog that appears when using mode=auto with prefilled parameters
- ✅ Added comprehensive "Security: consent dialog for automatic creation" section
- ✅ Explains user must explicitly confirm workspace creation
- ✅ Lists what information is displayed in the dialog
- ✅ Provides security rationale (protection against malicious links)
- ✅ Includes screenshot of the consent dialog

All documentation requirements have been addressed in the latest commits.

Automated review via Coder Tasks

matifali

Thanks. Can you also add a small note calling the breaking behaviour? Will help write changelog

matifali · 2026-02-12T12:22:55Z

Another minor nit on the color of the button. Do we have another option, as red is usually used for destructive operations?
cc: @chrifro

kacpersaw · 2026-02-12T13:46:02Z

Another minor nit on the color of the button. Do we have another option, as red is usually used for destructive operations? cc: @chrifro

@matifali
We can use our default variant for a button. WDYT?

matifali · 2026-02-12T14:04:38Z

@kacpersaw, yes, this looks better to me.

kacpersaw · 2026-02-12T14:15:59Z

@kacpersaw, yes, this looks better to me.

@matifali done! 👍

feat(site): add consent prompt for auto-creation with prefilled param…

302c40e

…eters

kacpersaw requested review from jakehwll and jdomeracki-coder February 9, 2026 14:44

github-actions bot assigned kacpersaw Feb 9, 2026

kacpersaw marked this pull request as ready for review February 9, 2026 14:45

kacpersaw and others added 2 commits February 9, 2026 15:45

Merge branch 'main' into kacpersaw/consent-prompt-auto-create

61c08ff

fix: remove unused import

16c5e2d

fix: update auto-create test to handle consent dialog

e077cb6

jakehwll reviewed Feb 9, 2026

View reviewed changes

site/src/pages/CreateWorkspacePage/CreateWorkspacePage.tsx Outdated Show resolved Hide resolved

jakehwll reviewed Feb 9, 2026

View reviewed changes

site/src/pages/CreateWorkspacePage/CreateWorkspacePage.tsx Outdated Show resolved Hide resolved

jakehwll reviewed Feb 9, 2026

View reviewed changes

site/src/pages/CreateWorkspacePage/CreateWorkspacePage.tsx Outdated Show resolved Hide resolved

jakehwll reviewed Feb 9, 2026

View reviewed changes

site/src/pages/CreateWorkspacePage/CreateWorkspacePage.tsx Outdated Show resolved Hide resolved

fix: update e2e auto-create tests to handle consent dialog

e899889

refactor: address PR review comments for consent dialog

9e28fdd

jdomeracki-coder approved these changes Feb 10, 2026

View reviewed changes

jakehwll reviewed Feb 10, 2026

View reviewed changes

site/src/pages/CreateWorkspacePage/AutoCreateConsentDialog.tsx Show resolved Hide resolved

Update site/src/pages/CreateWorkspacePage/AutoCreateConsentDialog.tsx

b14e52f

Co-authored-by: Jake Howell <jacob@coder.com>

jakehwll approved these changes Feb 10, 2026

View reviewed changes

kacpersaw added 3 commits February 11, 2026 10:16

feat: add storybook stories for AutoCreateConsentDialog

1620443

fix: update dialog structure and story formatting

f90608a

fix: prevent code block from overflowing dialog width

00471f1

Merge branch 'main' into kacpersaw/consent-prompt-auto-create

5d1df9e

docs: document security consent dialog for mode=auto creation

27283e3

kacpersaw requested a review from matifali February 12, 2026 10:22

kacpersaw changed the title ~~feat(site): add consent prompt for auto-creation with prefilled parameters~~ feat(site)!: add consent prompt for auto-creation with prefilled parameters Feb 12, 2026

github-actions bot added the release/breaking This label is applied to PRs to detect breaking changes as part of the release process label Feb 12, 2026

matifali approved these changes Feb 12, 2026

View reviewed changes

kacpersaw added 2 commits February 12, 2026 14:14

fix: use default button variant for confirm action

81d4a99

docs: update consent dialog screenshot

2c7939c

kacpersaw merged commit 60e3ab7 into main Feb 12, 2026
36 of 39 checks passed

kacpersaw deleted the kacpersaw/consent-prompt-auto-create branch February 12, 2026 14:39

github-actions bot locked and limited conversation to collaborators Feb 12, 2026

Conversation

kacpersaw commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Breaking behavior change

Uh oh!

coder-tasks bot commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Check

Updates Needed

Context

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jdomeracki-coder commented Feb 9, 2026

Uh oh!

jdomeracki-coder left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jakehwll left a comment

Choose a reason for hiding this comment

Uh oh!

coder-tasks bot commented Feb 11, 2026

Documentation Check

Updates Needed

Uh oh!

coder-tasks bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Check

Updates Needed

Uh oh!

matifali left a comment

Choose a reason for hiding this comment

Uh oh!

matifali commented Feb 12, 2026

Uh oh!

kacpersaw commented Feb 12, 2026

Uh oh!

matifali commented Feb 12, 2026

Uh oh!

kacpersaw commented Feb 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kacpersaw commented Feb 9, 2026 •

edited

Loading

coder-tasks bot commented Feb 9, 2026 •

edited

Loading

coder-tasks bot commented Feb 11, 2026 •

edited

Loading