ga/buhapp-telegram
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Min fix: credentials:'include' + Authorization только для мутаций

Browse Source 
GET использует cookie (без preflight), POST/PUT/DELETE — Authorization Bearer
This commit is contained in:
root 2026-08-20 21:56:02 +00:00
parent 06c8f8b593
commit fd8f6b38d0
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
public/js/api.js
View File

@ -42,14 +42,16 @@ const Store = {
async function api(path, opts = {}) { async function api(path, opts = {}) {
opts.headers = opts.headers || {}; opts.headers = opts.headers || {};
if (Store.access && !opts.headers.Authorization) { // для GET используем cookie (без CORS preflight), для мутаций — Authorization
const isGet = !opts.method || opts.method === 'GET' || opts.method === 'HEAD';
if (Store.access && !opts.headers.Authorization && !isGet) {
opts.headers.Authorization = `Bearer ${Store.access}`; opts.headers.Authorization = `Bearer ${Store.access}`;
} }
if (opts.body && typeof opts.body === 'object' && !(opts.body instanceof FormData)) { if (opts.body && typeof opts.body === 'object' && !(opts.body instanceof FormData)) {
opts.headers['Content-Type'] = 'application/json'; opts.headers['Content-Type'] = 'application/json';
opts.body = JSON.stringify(opts.body); opts.body = JSON.stringify(opts.body);
} }
let r = await fetch(API_BASE + path, opts); let r = await fetch(API_BASE + path, { ...opts, credentials: 'include' });
if (r.status === 401 && Store.refresh) { if (r.status === 401 && Store.refresh) {
// refresh // refresh
const r2 = await fetch(API_BASE + '/api/v1/auth/refresh', { const r2 = await fetch(API_BASE + '/api/v1/auth/refresh', {