equinor / equinor/fusion-framework
Missing bearer token on proxy assets
- Dominant language
- TypeScript
- Stars
- 10
- Forks
- 10
- Avg merge
- 19h 40m
- Merged PRs (30d)
- 150
Description
## Issue
When loading external (app service) source code with `@equinor/fusion-framework-vite-plugin-spa` the service-worker will add bearer token to the initial request, then rewrite the request to the local proxy route, which will be the `import.url` for the loaded script. If the loaded script has assets or code splitting, no token will apply since it skips the service-worker and executes request directly to `@equinor/fusion-framework-vite-plugin-api-service`.
## Reproduce
use the CLI and load an external application (example `ffc portal dev` and navigate to `/apps/some-app-with-assets`) and the resources loaded from the initial app script will be missing bearer token in headers
## Proposed Solution
### Option 1
Add a proxy-host token set to store and re-use tokens to that host if bearer is missing in request.
> [!warning]
> - all requests to `@equinor/fusion-framework-vite-plugin-api-service` to that proxy-host will include token, _might not what we want?__
> - if request is executed before snatched before service-worker re-write will not obtain token, __should not happen__
### Option 2
remove the service-worker and use `@equinor/fusion-framework-module-msal-node` to authenticate the user before starting the dev-server
> [!warning]
> the front-end app registration does not support node login and uses an own CLI application registration. This might lead to different access policies than "real world".
Contributor guide
Assessment
This issue has not been assessed yet.