Repository navigation
fix(client): send the cookie transport header on unsafe adapter requests - #234
Merged
Merged
Conversation
Server adapters from v0.23 refuse a body-less unsafe request to their auth routes that carries neither a JSON content type nor x-seamless-auth-transport. Cookie transport now names itself on POST, PUT, PATCH and DELETE requests to the adapter, including POST /refresh and authorizedFetch calls under the adapter mount, so body-less calls pass. Safe methods stay unmarked to avoid a CORS preflight, and requests to the application's own routes are unchanged. Refs fells-code/seamless-auth-api#558
This was referenced Nov 3, 2026
This was referenced Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cookie transport now sends
x-seamless-auth-transport: cookieon every unsafe request (POST,PUT,PATCH,DELETE) to the server adapter, includingPOST /refreshandauthorizedFetchcalls under the adapter mount.Why
The v0.21 security review (fells-code/seamless-auth-api#558) found that a body-less form
POSTfrom a sibling subdomain reaches cookie-authenticated adapter routes. All four adapters are adding a gate: a body-less unsafe auth request needs a JSON content type or this header, otherwise 415unsupported_media_type. A custom header forces a CORS preflight, which a cross-site form cannot pass. This client release has to ship before the adapter releases (fells-code/seamless-auth-go#30, fells-code/seamless-auth-python#33, fells-code/seamless-auth-rust#34, and the Node adapters), so current calls such as recovery code generation and sign-out keep working.Details
GET /users/mestays a simple request.trustedOriginsare unchanged.beareron everything. A header the caller passes still wins.apiHost(same origin), an absolute URL under the page origin's/authmount is now recognized as an adapter call, in both modes.Checks
Jest 857 tests, Vitest (Svelte) 56, lint, typecheck, format and build pass.