From f17bdadb64ecfd11ca5ebc00dfa22a65ef9a5bb0 Mon Sep 17 00:00:00 2001 From: Andres Pinto <143480783+apsantiso@users.noreply.github.com> Date: Tue, 3 Nov 2026 16:00:36 +0100 Subject: [PATCH 1/2] chore: only send credentials on prod --- src/app/core/factory/sdk/index.test.ts | 18 ++++++++++++++++++ src/app/core/factory/sdk/index.ts | 8 ++++++-- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/src/app/core/factory/sdk/index.test.ts b/src/app/core/factory/sdk/index.test.ts index c25e7c304..641710b0d 100644 --- a/src/app/core/factory/sdk/index.test.ts +++ b/src/app/core/factory/sdk/index.test.ts @@ -11,6 +11,7 @@ import { HttpClient } from '@internxt/sdk/dist/shared/http/client'; import { USER_NOTIFICATION_MAX_RETRIES } from './retryStrategies'; import notificationsService, { ToastType } from 'app/notifications/services/notifications.service'; import dateService from 'services/date.service'; +import envService from 'services/env.service'; import { EncryptedStorageService } from 'services/encrypted-storage.service'; import { WorkspaceCredentialsDetails } from '@internxt/sdk/dist/workspaces'; @@ -65,6 +66,7 @@ vi.mock('services/date.service', () => ({ vi.mock('services/env.service', () => ({ default: { + isProduction: vi.fn(() => true), getVariable: vi.fn((key: string) => { if (key === 'newApi') return MOCKED_NEW_API; if (key === 'payments') return MOCKED_PAYMENTS; @@ -442,6 +444,22 @@ describe('SdkFactory', () => { { withCredentials: true }, ); }); + test('When not in production, then the auth clients are created without credentials', () => { + vi.mocked(envService.isProduction).mockReturnValue(false); + + const instance = SdkFactory.getNewApiInstance(); + instance.createAuthClient(); + instance.createDesktopAuthClient(); + + expect(Auth.client).toHaveBeenNthCalledWith(1, MOCKED_NEW_API, expect.any(Object), expect.any(Object), { + withCredentials: false, + }); + expect(Auth.client).toHaveBeenNthCalledWith(2, MOCKED_NEW_API, expect.any(Object), expect.any(Object), { + withCredentials: false, + }); + + vi.mocked(envService.isProduction).mockReturnValue(true); + }); }); describe('Creating the location client', () => { diff --git a/src/app/core/factory/sdk/index.ts b/src/app/core/factory/sdk/index.ts index 433739e8d..1df11d5fa 100644 --- a/src/app/core/factory/sdk/index.ts +++ b/src/app/core/factory/sdk/index.ts @@ -65,7 +65,7 @@ export class SdkFactory { turnstileToken: options?.turnstileToken, }); const apiSecurity = this.getNewApiSecurity(options?.unauthorizedCallback); - return Auth.client(apiUrl, appDetails, apiSecurity, { withCredentials: true }); + return Auth.client(apiUrl, appDetails, apiSecurity, SdkFactory.getAuthHttpOptions()); } public createDesktopAuthClient(options?: { turnstileToken?: string }): Auth { @@ -74,7 +74,7 @@ export class SdkFactory { options?.turnstileToken ? { 'x-internxt-turnstile': options.turnstileToken } : undefined, ); const apiSecurity = this.getNewApiSecurity(); - return Auth.client(apiUrl, appDetails, apiSecurity, { withCredentials: true }); + return Auth.client(apiUrl, appDetails, apiSecurity, SdkFactory.getAuthHttpOptions()); } public createNewStorageClient(): Storage { @@ -178,6 +178,10 @@ export class SdkFactory { return this.apiUrl; } + private static getAuthHttpOptions(): { withCredentials: boolean } { + return { withCredentials: envService.isProduction() }; + } + private static getAppDetails(customHeaders?: Record): AppDetails { return { clientName: packageJson.name, From 21fd1fd0e7069f7b3230a22bc8ddd6509cfd41ef Mon Sep 17 00:00:00 2001 From: Andres Pinto <143480783+apsantiso@users.noreply.github.com> Date: Tue, 3 Nov 2026 16:11:34 +0100 Subject: [PATCH 2/2] chore: use a flag instead of production --- .env.example | 1 + src/app/core/factory/sdk/index.test.ts | 12 ++++++++---- src/app/core/factory/sdk/index.ts | 2 +- src/services/env.service.ts | 1 + 4 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.env.example b/.env.example index 5e617b73c..8ba3ac0eb 100644 --- a/.env.example +++ b/.env.example @@ -28,5 +28,6 @@ REACT_APP_META_PIXEL= REACT_APP_TURNSTILE_SITE_KEY=turnstile_site_key REACT_APP_TURNSTILE_ENABLED=false +REACT_APP_SEND_COOKIES_ON_AUTH_REQUESTS=false REACT_APP_MAX_PREVIEWABLE_FILE_SIZE_IN_BYTES=536870912 diff --git a/src/app/core/factory/sdk/index.test.ts b/src/app/core/factory/sdk/index.test.ts index 641710b0d..fea753acf 100644 --- a/src/app/core/factory/sdk/index.test.ts +++ b/src/app/core/factory/sdk/index.test.ts @@ -66,11 +66,11 @@ vi.mock('services/date.service', () => ({ vi.mock('services/env.service', () => ({ default: { - isProduction: vi.fn(() => true), getVariable: vi.fn((key: string) => { if (key === 'newApi') return MOCKED_NEW_API; if (key === 'payments') return MOCKED_PAYMENTS; if (key === 'location') return MOCKED_LOCATION; + if (key === 'sendCookiesOnAuthRequests') return 'true'; return ''; }), }, @@ -444,8 +444,12 @@ describe('SdkFactory', () => { { withCredentials: true }, ); }); - test('When not in production, then the auth clients are created without credentials', () => { - vi.mocked(envService.isProduction).mockReturnValue(false); + test('When sending cookies on auth requests is disabled, then the auth clients are created without credentials', () => { + const getVariable = vi.mocked(envService.getVariable); + const defaultImpl = getVariable.getMockImplementation(); + getVariable.mockImplementation((key) => + key === 'sendCookiesOnAuthRequests' ? 'false' : (defaultImpl?.(key) ?? ''), + ); const instance = SdkFactory.getNewApiInstance(); instance.createAuthClient(); @@ -458,7 +462,7 @@ describe('SdkFactory', () => { withCredentials: false, }); - vi.mocked(envService.isProduction).mockReturnValue(true); + getVariable.mockImplementation(defaultImpl!); }); }); diff --git a/src/app/core/factory/sdk/index.ts b/src/app/core/factory/sdk/index.ts index 1df11d5fa..69ca4bb08 100644 --- a/src/app/core/factory/sdk/index.ts +++ b/src/app/core/factory/sdk/index.ts @@ -179,7 +179,7 @@ export class SdkFactory { } private static getAuthHttpOptions(): { withCredentials: boolean } { - return { withCredentials: envService.isProduction() }; + return { withCredentials: envService.getVariable('sendCookiesOnAuthRequests') === 'true' }; } private static getAppDetails(customHeaders?: Record): AppDetails { diff --git a/src/services/env.service.ts b/src/services/env.service.ts index 62f2a910e..2ecfa4343 100644 --- a/src/services/env.service.ts +++ b/src/services/env.service.ts @@ -39,6 +39,7 @@ const variableList = { recaptchaV3: 'REACT_APP_RECAPTCHA_V3', turnstileSiteKey: 'REACT_APP_TURNSTILE_SITE_KEY', turnstileEnabled: 'REACT_APP_TURNSTILE_ENABLED', + sendCookiesOnAuthRequests: 'REACT_APP_SEND_COOKIES_ON_AUTH_REQUESTS', shareLinksDomain: 'REACT_APP_SHARE_LINKS_DOMAIN', proxy: 'REACT_APP_PROXY', dontUseProxy: 'REACT_APP_DONT_USE_PROXY',