CORS is not reflected in Ajax calls (requests are send as anonymous)

This patch works in our situation. Please review.

Fixed the small errors that were found.

There's a security issue with doing this universally

I think it needs to be something sites can knowingly opt into

It's only applied (to all Ajax requests) if you set "supportsCredentials: true" in cors.config
Or do you mean find a means to enable it per Ajax request individually?

I mean globally - we could probably read CORS config from the container Params and use that to inject something into Drupal settings

That's what the patch does do no?

// If CORS is enabled, make sure ajax calls send the credentials if needed.
+ $cors_config = \Drupal::getContainer()->getParameter('cors.config');
+ $settings['ajaxCrossDomain'] = [
+ 'withCredentials' => $cors_config['supportsCredentials'] ?? FALSE,
+ ];

??

Ha, sorry I didn't look at the merge request - yeah like that exactly 😂 serves me right from replying on my phone

We have the ability to test drupalSettings so I think we should at least add a test to ensure that flag is set.

The Needs Review Queue Bot → tested this issue. It fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.

I think something went wrong here for the merge requests. :/

update issue to 10.1.x

kriboogh → changed the visibility of the branch 3338518-cors-is-not to hidden.

kriboogh → changed the visibility of the branch 3338518-cors-ajax-101 to hidden.

Added a basic test to see if the drupalSetting is set in javascript if supportsCredentials is set in config.

kriboogh → closed merge request !3369

kriboogh → closed merge request !5427

The Needs Review Queue Bot → tested this issue. It fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.

Fix reported error

Appears MR has a failure. Could it be updated to point to 11.x please as that's the current development branch.

kriboogh → closed merge request !5428

I'll closed this one, and start fresh for 11.x at 3450553, is gonna be easier then trying to rebase all this. work will continue there.