Consider supporting httpOnly cookie for storing token about aurelia-authentication HOT 3 CLOSED

The server set tHr cookie and isn.t the point that client side scripts cannot access it? As i understood it, everything here is as usual. Additionally, the cookie is set by the server when requesting your token. Then, when eg refreshing the server additionally checks that cookie. There is nothing to do on the client side. It.s all server side

from aurelia-authentication.

Yes, you are correct - it is primary a server side thing.

However, there is one configuration item to be done on the client in order to get the cookie to be sent to the server with each request:

The fetch client needs to have credentials: 'include', set. When I use the fetch client, I do this:

this.httpClient.configure((config: any) => {
			config
				.withDefaults({
					credentials: 'include',
					headers: {
						"Authorization": bearerToken
					}
				});
		});

But how do I configure the instance of the fetch client that Aurelia-orm is using?

from aurelia-authentication.

Ok, I found how to do this:

.plugin(PLATFORM.moduleName('aurelia-api'),
        config => {
            config
                .registerEndpoint('protected-api', ServiceConfig.serviceName, {credentials:'include'})
		})

from aurelia-authentication.