Demos - Anti Forgery no CORS / credentials (DevExpress#32628)

Author: mpreyskurantov

apps/demos/shared/anti-forgery/fetch-override.js

@@ -9,7 +9,7 @@ async function fetchAntiForgeryToken() {
   try {
     const response = await fetchOrig('https://js.devexpress.com/Demos/NetCore/api/Common/GetAntiForgeryToken', {
       method: 'GET',
-      credentials: 'include',
+      // credentials: 'include',
       cache: 'no-cache',
     });
 
@@ -67,7 +67,7 @@ ajax.sendRequest = (options) => {
     };
 
     options.xhrFields = {
-      withCredentials: true,
+      // withCredentials: true,
     };
 
     sendRequestOrig(options).then(
@@ -94,7 +94,7 @@ window.fetch = async (url, options = {}) => {
     ...(options.headers || {}),
   };
 
-  options.credentials = 'include';
+  // options.credentials = 'include';
 
   return fetchOrig(url, options);
 };

apps/demos/shared/anti-forgery/jquery-override.js

@@ -9,7 +9,7 @@ function fetchAntiForgeryToken() {
   orig$.ajax({
     url: 'https://js.devexpress.com/Demos/NetCore/api/Common/GetAntiForgeryToken',
     method: 'GET',
-    xhrFields: { withCredentials: true },
+    // xhrFields: { withCredentials: true },
     cache: false,
   }).done((data) => {
     d.resolve(data);
@@ -56,7 +56,10 @@ async function setAntiForgery() {
     }
 
     options.headers = { [tokenData.headerName]: tokenData.token, ...(options.headers || {}) };
-    options.xhrFields = { withCredentials: true, ...(options.xhrFields || {}) };
+    options.xhrFields = {
+      // withCredentials: true,
+      ...(options.xhrFields || {}),
+    };
 
     return originalAjax.call(this, options);
   };
@@ -68,7 +71,7 @@ async function setAntiForgery() {
     };
 
     options.xhrFields = {
-      withCredentials: true,
+      // withCredentials: true,
       ...(options.xhrFields || {}),
     };