Allow the CMS to include browsers cookies in requests sent to git-gateway
- Dominant language
- JavaScript
- Stars
- 19.4k
- Forks
- 3.1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 9
Description
When connecting to the git gateway through XHR requests, NetlifyCMS doesn't include cookies.
We are running our own instance of the git gateway, and we would like to move it behind our corporate network for security reasons. We use [Identity-Aware Proxy](https://cloud.google.com/iap), which identifies secured sessions with a cookie that's injected by IAP. Because of this, all XHR requests from NetlifyCMS to the git gateway fail because they aren't authenticated into our network.
This appears to be the piece of code that's causing this: . `fetch` doesn't include cookies by default. It only includes them if you pass the `credentials: "include"` option.
If NetlifyCMS could include cookies in its requests, it would allow us to increase the security of our website by keeping the CMS off of the public Internet. Either getting this change in directly, or having an option to do this, would be very helpful for us.
Thanks
Contributor guide
Research direction
Start in cypress/plugins/gitGateway.js at the linked fetch call and inspect how requests to the git gateway are assembled. Confirm the desired cookie behavior or configuration option, then verify that XHR requests can authenticate through the cookie-backed gateway without breaking existing requests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100