Make requests not send credentials

[cameron-martin]

Summary

Make gatsby not send credentials when making requests - currently in the following 2 places:

gatsby/packages/gatsby/cache-dir/loader.js

Line 87 in eaa08cf

req.withCredentials = true

gatsby/packages/gatsby/cache-dir/static-entry.js

Line 300 in eaa08cf

crossOrigin="use-credentials"

Motivation

We have a slightly weird setup where our assets are on a CDN (enabled by the new assetPrefix option), which is a different domain from where the pages are served. This means we have to serve the assets with CORS headers. Moreover, we need them accessible from multiple origins and the headers must be static so we have to set Access-Control-Allow-Origin to *. Having this header set this way means that browsers error when doing XHRs with credentials.

My initial thought was that credentials can be removed for everyone without causing issues, but some people may have their static sites behind an authentication proxy which means credentials will need to be sent in some cases.

[pieh]

This is weird case - reason for using this in first place is that <link rel="preload"> tag we add to and then fetching it sometimes would create duplicated requests (that's why XHR is used there and not fetch ... and that's why there is bunch of weird attributes) - see 9008479 for change that was made that added this

[pieh]

I'm not sure if anyone actually is using credentials, so if we can replicate behaviour of not duplicated requests I not use this, I would be in favour of it. It was some time ago since I tested it, and might be it was fixed - if it was chrome bug then (it might be just security reasons, didn't find much information on this topic).

In general I would very much love to avoid adding options like that and adjust what currently is there if possible

[cameron-martin]

This is weird case - reason for using this in first place is that tag we add to and then fetching it sometimes would create duplicated requests (that's why XHR is used there and not fetch ... and that's why there is bunch of weird attributes)

So is it setting withCredentials that fixes this bug, or the switch from fetch -> XHR or a combination of both? Do you have any more details on this bug?

I'm not sure if anyone actually is using credentials

I'm not sure either, but a valid use-case for this would be a static site sitting behind an authentication proxy. But I'm not sure if anyone is doing this, or whether this actually works (since every request would have to be done with credentials enabled for this to work).

In general I would very much love to avoid adding options like that and adjust what currently is there if possible

Yeah it does seem silly to add such a specific option - I probably should have opened this as a bug report instead.

[pieh]

over 1 year ago I used https://github.com/pieh/link-preload-fetch as barebone example of issue - I don't remember specifics but I think that not using withCredentials was resulting in double requests (I'm not quite sure if this is bug or intended behaviour, as I mentioned I couldn't find much information back then)

[cameron-martin]

I just ran that demo and:

• In chrome, everything except "base" only results in 1 request to data.json.
• In firefox, they all result in only 1 request.
• In edge, the top 2 result in 2 requests, and the bottom 2 result in only 1 request.

Possibly we could use crossorigin="anonymous" / xhr now then?

[gatsbot]

Hiya!

This issue has gone quiet. Spooky quiet. 👻

We get a lot of issues, so we currently close issues after 30 days of inactivity. It’s been at least 20 days since the last update here.

If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out gatsby.dev/contribute for more information about opening PRs, triaging issues, and contributing!

Thanks for being a part of the Gatsby community! 💪💜

[cameron-martin]

Not stale

[xavivars]

We're also facing this problem: multiple hosts (xxxxxx.com, xxxxxx.fr, xxxxx.ie,...) need to access same CDN where assets live.

[id0Sch]

I'm facing this issue when trying to host the site on google-cloud-storage.
i'm using assetsPrefix, and have no way of adding the Access-Control-Allow-Credentials header.
AFAIK - there's no way of using gatsby with google-cloud-storage.
(found a relevant thread here: https://issuetracker.google.com/issues/123376293)

[xavivars]

I'd love to help to fix this issue, if there's interest...