Best way to secure VS Code instance

[WizzardMaker]

I saw a PR (#26) that talked about login/auth to prevent unauthorized access to my hosted vs code, is that not implemented yet, or did I miss a setting to enable that feature on my instance?

[dwilliamhouston]

I think if you read down the bottom of the PR it shows it was pulled as it wasnt working properly, at least thats the way I read it. Hopefully this gets resolved as its difficult to justify on a public server.

[WizzardMaker]

Yeah, I saw that. Let's hope they add this features

[Complexicon]

for the time being while we have no proper auth try proxying openvscode-server through nginx or apache2 and then wrap it around a basic auth realm like i did in my apache2 config here.

works fine for me but i am experiencing an issue where i cant restrict the server to only listen on connections on localhost making it pretty much useless if other parties figure out your vscode port

[starmadegeek]

I don't understand you cannot restrict the server to only listen on localhost. Your firewall should block all un-exposed port connections by default. Preferably you only should have 443(https)/80(http) port exposed to web. And Apache2/Nginx can connect to your vscode on any port on localhost and route external connections through 443/80 without exposing your vscode server.

[mbtools]

I restrict my hosted systems by IP address range. That eliminates the vast majority of bad actors. Works well since I work only from a few locations.

[leifwalsh]

I opened this which you may be interested in if you run multi-user hosts: #144