decaporg / decaporg/decap-cms

Allow the CMS to include browsers cookies in requests sent to git-gateway

Open
#4,115 3 comments 0 reactions 0 assignees View on GitHub
area: extensions/backends type: feature
Dominant language
JavaScript
Stars
19.4k
Forks
3.1k
Avg merge
1d 14h
Merged PRs (30d)
9

Description

When connecting to the git gateway through XHR requests, NetlifyCMS doesn't include cookies.

We are running our own instance of the git gateway, and we would like to move it behind our corporate network for security reasons. We use [Identity-Aware Proxy](https://cloud.google.com/iap), which identifies secured sessions with a cookie that's injected by IAP. Because of this, all XHR requests from NetlifyCMS to the git gateway fail because they aren't authenticated into our network.

This appears to be the piece of code that's causing this: . `fetch` doesn't include cookies by default. It only includes them if you pass the `credentials: "include"` option.

If NetlifyCMS could include cookies in its requests, it would allow us to increase the security of our website by keeping the CMS off of the public Internet. Either getting this change in directly, or having an option to do this, would be very helpful for us.

Thanks

Contributor guide

Open the contributing guide

Research direction

Start in cypress/plugins/gitGateway.js at the linked fetch call and inspect how requests to the git gateway are assembled. Confirm the desired cookie behavior or configuration option, then verify that XHR requests can authenticate through the cookie-backed gateway without breaking existing requests.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, authentication
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.