search

adobe / helix-sidekick-extension

Browser extension for authors on AEM projects
Apache License 2.0
21 stars 39 forks source link

fix: cookie-less auth cleanup. remove credentials: include #849

Closed andreituicu closed 5 days ago

andreituicu commented 2 weeks ago

Since the AEM Sidekick no longer uses cookies for authentication to Admin, we can remove the credentials: 'include' option from fetch requests to Admin.

Manually the following flows in the browser:

Site with Admin Without login (Sharepoint)

Site with Admin With login (Sharepoint)

Site with Admin with login (Google Drive)

rofe commented 2 weeks ago

@andreituicu we're going to have to merge this into a feature branch on the original repo to make sure all checks are being run before we merge it into main.

andreituicu commented 2 weeks ago

@rofe I pushed the branch directly in the repo https://github.com/adobe/helix-sidekick-extension/tree/remove-credentials-include now that I received write permissions, looks like this triggered the checks. If you'd like I can close this PR and re-open it directly from the branch in the repo to have everything cleanly executed.

andreituicu commented 2 weeks ago

Did the same level of testing as on the new sidekick. As mentioned in https://github.com/adobe/aem-sidekick/pull/353#issuecomment-2474182346 , I would maybe give it a few more days before merging to see if there are any reports of problems in the new sidekick.

rofe commented 6 days ago

@andreituicu is this one good to merge now?

andreituicu commented 6 days ago

@rofe I think yes. The new sidekick has the same code already in place for 2 weeks and there were no complains, so I think it should be safe. thank you!

rofe commented 5 days ago

Continued in #853