Skip to content

Accept session cookie auth params via headers and query parameters

Timo Furrer requested to merge feature/cookie-auth-query-params into master

The browser Websocket API doesn't support sending custom HTTP headers via the connection upgrade request and thus, we must send the agent id and CSRF token in the query parameters instead of the headers.

This change set implements that KAS supports both, no matter if for websocket connections or not. KAS will prefer the headers over the query parameters and doesn't fail if both are provided - even if their values are inconsistently. We may change this in a follow up.

cc @afontaine

Closes #438 (closed)

Edited by Timo Furrer

Merge request reports