Merge pull request #149 from mohamed-cds/feat/toggle_xhr_cookie_credentials

feat: support xhr cross-site cookie credentials

Author: nscuro

docker/docker-entrypoint.sh

@@ -8,6 +8,7 @@ if mount | grep '/static/config.json'; then
 else
   # Apply ENV vars to temporary config.json
   jq '.API_BASE_URL = env.API_BASE_URL
+        | .API_WITH_CREDENTIALS = env.API_WITH_CREDENTIALS 
         | .OIDC_ISSUER = env.OIDC_ISSUER
         | .OIDC_CLIENT_ID = env.OIDC_CLIENT_ID
         | .OIDC_SCOPE = env.OIDC_SCOPE

public/static/config.json

@@ -1,5 +1,6 @@
 {
   "API_BASE_URL": "",
+  "API_WITH_CREDENTIALS": "",
   "OIDC_ISSUER": "",
   "OIDC_CLIENT_ID": "",
   "OIDC_SCOPE": "openid email profile",

src/App.vue

@@ -38,6 +38,17 @@
 
       setJwtForAjax(getToken());
 
+      // Send XHR cross-site cookie credentials
+      if (this.$api.WITH_CREDENTIALS){
+        this.axios.interceptors.request.use(
+          function(config) {
+            config.withCredentials = true;
+            return config;
+          }
+        );
+        $.ajaxSettings.xhrFields = { withCredentials: true };
+      }
+
       // debug logging of ajax requests/responses
       if (getUrlVar('debug')) {
         $(document).ajaxComplete((event, xhr) => {

src/main.js

@@ -44,6 +44,10 @@ axios.get(contextPath + "/static/config.json").then(response => {
   } else {
     Vue.prototype.$api.BASE_URL = contextPath;
   }
+
+  // Send XHR cross-site cookie credentials
+  Vue.prototype.$api.WITH_CREDENTIALS = response.data.API_WITH_CREDENTIALS && response.data.API_WITH_CREDENTIALS.toLowerCase() === "true";
+
   // OpenID Connect
   Vue.prototype.$oidc.ISSUER = response.data.OIDC_ISSUER;
   Vue.prototype.$oidc.CLIENT_ID = response.data.OIDC_CLIENT_ID;

src/shared/api.json

@@ -9,6 +9,7 @@
   "METHOD_PUT": "PUT",
   "METHOD_DELETE": "DELETE",
   "FORCE_PASSWORD_CHANGE": "FORCE_PASSWORD_CHANGE",
+  "WITH_CREDENTIALS": "",
 
   "BASE_URL": "",
   "URL_ABOUT": "api/version",