claude-code - 💡(How to fix) Fix [FEATURE] Use a Virtual-Hosted Style URL for GCS in Native Install [1 comments, 2 participants]

Our environment restricts network access to only allow connections to explicitly approved hosts. However, the Native Install uses GCS Path-Style URLs (e.g., https://storage.googleapis.com/<bucket-name>/...), which means we must allowlist all GCS buckets to install Claude Code. This creates an unnecessarily broad security exception.

TL;DR

Switching to Virtual-Hosted Style GCS URLs or adding a configuration option to choose between URL styles can help mitigate the security exception issue.

Guidance

• Investigate the feasibility of switching to Virtual-Hosted Style GCS URLs, as proposed in the issue, to reduce the scope of the security exception.
• Consider adding a configuration option to allow users to choose between Path-Style and Virtual-Hosted Style URLs, providing flexibility for environments with different security requirements.
• Review the documentation on GCS request endpoints to understand the differences between Path-Style and Virtual-Hosted Style URLs and their implications for security and configuration.
• Evaluate the potential impact of this change on existing workflows and dependencies, such as CLI commands and flags.

Example

No code snippet is provided, as the issue focuses on configuration and URL style changes rather than specific code modifications.

Notes

The solution may require updates to the Native Install process and potentially other components that interact with GCS. It is essential to consider the potential effects on productivity and security when implementing this change.

Recommendation

Apply workaround by adding a configuration option to choose between Path-Style and Virtual-Hosted Style URLs, as this provides a flexible solution that can accommodate different environments and security requirements.