Skip to content

Commit 07469a4

Browse files
fix: same site api call with session cookie (#8435)
## About the changes This fixes #8029. How to reproduce the issue is in the ticket. The issue happens because when a web app is hosted in the same domain as Unleash UI and the web app uses unleash SDK to make requests to Unleash, the browser automatically includes the cookie in the request headers, because: - The request URL matches the cookie's Path attribute (which it does in this case). - The request is sent to the same domain (which it is, since both apps are under the same domain). And this is by design in the HTTP cookie specification: https://datatracker.ietf.org/doc/html/rfc6265 This PR avoids overriding the API user with the session user if there's already an API user in the request. It's an alternative to #8434 Closes #8029
1 parent fc1f058 commit 07469a4

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

src/lib/middleware/authorization-middleware.ts

+1-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import type { LogProvider } from '../logger';
44
import { AuthenticationRequired } from '../server-impl';
55
import UnauthorizedError from '../error/unauthorized-error';
66

7-
/* eslint-disable @typescript-eslint/explicit-module-boundary-types */
87
const authorizationMiddleware = (
98
getLogger: LogProvider,
109
baseUriPath: string,
@@ -13,7 +12,7 @@ const authorizationMiddleware = (
1312
logger.debug('Enabling Authorization middleware');
1413

1514
return async (req: IAuthRequest, res: Response, next: NextFunction) => {
16-
if (req.session?.user) {
15+
if (!req.user?.isAPI && req.session?.user) {
1716
req.user = req.session.user;
1817
return next();
1918
}

0 commit comments

Comments
 (0)