chore: only send credentials on prod

.env.example

@@ -28,5 +28,6 @@ REACT_APP_META_PIXEL=
 
 REACT_APP_TURNSTILE_SITE_KEY=turnstile_site_key
 REACT_APP_TURNSTILE_ENABLED=false
+REACT_APP_SEND_COOKIES_ON_AUTH_REQUESTS=false
 
 REACT_APP_MAX_PREVIEWABLE_FILE_SIZE_IN_BYTES=536870912

src/app/core/factory/sdk/index.test.ts

@@ -11,6 +11,7 @@ import { HttpClient } from '@internxt/sdk/dist/shared/http/client';
 import { USER_NOTIFICATION_MAX_RETRIES } from './retryStrategies';
 import notificationsService, { ToastType } from 'app/notifications/services/notifications.service';
 import dateService from 'services/date.service';
+import envService from 'services/env.service';
 import { EncryptedStorageService } from 'services/encrypted-storage.service';
 import { WorkspaceCredentialsDetails } from '@internxt/sdk/dist/workspaces';
 
@@ -69,6 +70,7 @@ vi.mock('services/env.service', () => ({
       if (key === 'newApi') return MOCKED_NEW_API;
       if (key === 'payments') return MOCKED_PAYMENTS;
       if (key === 'location') return MOCKED_LOCATION;
+      if (key === 'sendCookiesOnAuthRequests') return 'true';
       return '';
     }),
   },
@@ -442,6 +444,26 @@ describe('SdkFactory', () => {
           { withCredentials: true },
         );
       });
+      test('When sending cookies on auth requests is disabled, then the auth clients are created without credentials', () => {
+        const getVariable = vi.mocked(envService.getVariable);
+        const defaultImpl = getVariable.getMockImplementation();
+        getVariable.mockImplementation((key) =>
+          key === 'sendCookiesOnAuthRequests' ? 'false' : (defaultImpl?.(key) ?? ''),
+        );
+
+        const instance = SdkFactory.getNewApiInstance();
+        instance.createAuthClient();
+        instance.createDesktopAuthClient();
+
+        expect(Auth.client).toHaveBeenNthCalledWith(1, MOCKED_NEW_API, expect.any(Object), expect.any(Object), {
+          withCredentials: false,
+        });
+        expect(Auth.client).toHaveBeenNthCalledWith(2, MOCKED_NEW_API, expect.any(Object), expect.any(Object), {
+          withCredentials: false,
+        });
+
+        getVariable.mockImplementation(defaultImpl!);
+      });
     });
 
     describe('Creating the location client', () => {

src/app/core/factory/sdk/index.ts

@@ -65,7 +65,7 @@ export class SdkFactory {
       turnstileToken: options?.turnstileToken,
     });
     const apiSecurity = this.getNewApiSecurity(options?.unauthorizedCallback);
-    return Auth.client(apiUrl, appDetails, apiSecurity, { withCredentials: true });
+    return Auth.client(apiUrl, appDetails, apiSecurity, SdkFactory.getAuthHttpOptions());
   }
 
   public createDesktopAuthClient(options?: { turnstileToken?: string }): Auth {
@@ -74,7 +74,7 @@ export class SdkFactory {
       options?.turnstileToken ? { 'x-internxt-turnstile': options.turnstileToken } : undefined,
     );
     const apiSecurity = this.getNewApiSecurity();
-    return Auth.client(apiUrl, appDetails, apiSecurity, { withCredentials: true });
+    return Auth.client(apiUrl, appDetails, apiSecurity, SdkFactory.getAuthHttpOptions());
   }
 
   public createNewStorageClient(): Storage {
@@ -178,6 +178,10 @@ export class SdkFactory {
     return this.apiUrl;
   }
 
+  private static getAuthHttpOptions(): { withCredentials: boolean } {
+    return { withCredentials: envService.getVariable('sendCookiesOnAuthRequests') === 'true' };
+  }
+
   private static getAppDetails(customHeaders?: Record<string, string>): AppDetails {
     return {
       clientName: packageJson.name,

src/services/env.service.ts

@@ -39,6 +39,7 @@ const variableList = {
   recaptchaV3: 'REACT_APP_RECAPTCHA_V3',
   turnstileSiteKey: 'REACT_APP_TURNSTILE_SITE_KEY',
   turnstileEnabled: 'REACT_APP_TURNSTILE_ENABLED',
+  sendCookiesOnAuthRequests: 'REACT_APP_SEND_COOKIES_ON_AUTH_REQUESTS',
   shareLinksDomain: 'REACT_APP_SHARE_LINKS_DOMAIN',
   proxy: 'REACT_APP_PROXY',
   dontUseProxy: 'REACT_APP_DONT_USE_PROXY',