Open otherview opened 1 month ago
Attention: Patch coverage is 0%
with 16 lines
in your changes missing coverage. Please review.
Project coverage is 62.63%. Comparing base (
e5d76aa
) to head (7180749
).
Files | Patch % | Lines |
---|---|---|
api/api.go | 0.00% | 8 Missing :warning: |
cmd/thor/main.go | 0.00% | 8 Missing :warning: |
:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
Now that google scraps their plan to block 3rd party cookies, perhaps it's a good idea to explore this implementation further?
Description
This is a tentative fix for https://github.com/vechain/b3tr/issues/1123#issuecomment-2219331553
Issue:
This PR adds the following flags:
api-allowed-creds
andapi-allowed-origins
that used together changes the response headers so that it's ok to use Cookies and CORS.api-allowed-creds
sets theAccess-Control-Allow-Credentials
header to true.api-allowed-origins
sets the Access-Control-Allow-Origin to be set as the Origin request.Example: Before
Request{ Type:GET, To:www.yahoo.com, Header{'Origin:www.google.com', 'Access-Control-Allow-Credentials: true'}}
Response{ Type:GET, To:www.yahoo.com, Header{Access-Control-Allow-Origin:"*"}}
- which failsWith flags enabled
Request{ Type:GET, To:www.yahoo.com, Header{'Origin:www.google.com', 'Access-Control-Allow-Credentials: true'}}
Response{ Type:GET, To:www.yahoo.com, Header{Access-Control-Allow-Origin:"www.google.com", 'Access-Control-Allow-Credentials: true'}}
- which is okFixes # (issue)
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
Checklist: