feat: Add `Access-Control-Allow-Credentials` support.

AxeWP / wp-graphql-headless-login

A WordPress plugin that provides Headless login and authentication for WPGraphQL, supporting traditional passwords, OAuth2/OpenID Connect, JWT, and more.

GNU General Public License v3.0

66 stars 11 forks source link

feat: Add `Access-Control-Allow-Credentials` support. #74

Closed ArkDouglas closed 1 year ago

ArkDouglas commented 1 year ago

What

This will enable the check box on the admin side to add "Access-Control-Allow-Credentials" to the outgoing requests.

Why

This facilitates a missing need, given the other plugins that would perform this are incompatible. Closes #72

How

Add the necessary functionality in the proper settings files.

Testing Instructions

enable the plugin code base
Configure either client-side logging for returned requests, or add a log in the code
Make a request and view the header

Additional Info

Checklist:

[X] My code is tested to the best of my abilities.
[x] My code follows the WordPress Coding Standards.
[x] My code has proper inline documentation.
[x] I have added unit tests to verify the code works as intended. ** I'm not sure where to put these, a little guidance would be helpful here, if there are existing tests I can look at in a folder location. .
[x] I included the relevant changes in CHANGELOG.md

coveralls commented 1 year ago

Coverage: 83.776% (+0.1%) from 83.662% when pulling 9d133f994caf9761446561bca9133a4f2294fb0e on ArkDouglas:ISSUE-72-access-control-allow-credentials into c648d416ce8c346cf4232992272f207967a593ff on AxeWP:develop.

justlevine commented 1 year ago

Thanks so much for this @ArkDouglas !

I linted the PR to follow the bundled Coding Standards (in the future, you can run composer fix-cs to autofix, and composer check-cs to see if there's anything remaining), and hope to have time to review this ASAP.

If you want to take a stab at adding some tests in the interim, you can take a look at wpunit/RequestTest.php (mocks the request to ensure the request behaves per the settings) and functional/AuthenticatedQueryCest.php (tests a real request at a broader level).

PS: Both this and #72 are eligible for my WPGraphQL Spring Cleaning campaign, where I'm donating development hours to the WPGraphQL plugin/feature of your choice. If you're interested, please fill out the form at the above link, and let me know where you'd like me to direct the time.

justlevine commented 1 year ago

⚠️ I tweaked the logic a bit so ACAC only gets added if the origin is not a wildcard