token interceptor: send extra headers only on RA requests#1761
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the Angular TokenInterceptor to avoid attaching RocketAdmin-specific headers/credentials to non-RocketAdmin HTTP requests.
Changes:
- Adds URL-origin detection to decide when to attach
withCredentialsand extra headers. - Moves
GCLID/masterpwdheader injection behind anisApiRequestcondition.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| const url = new URL(request.url, location.origin); | ||
| const isApiRequest = url.origin === location.origin || url.origin == 'https://app.rocketadmin.com'; | ||
|
|
||
| request = request.clone({ | ||
| url: this.normalizeURL(request.url, environment.apiRoot || this.config.baseURL, environment.saasURL), | ||
| setHeaders: { | ||
| GCLID: autoadmin_gclid_cookie, | ||
| }, | ||
| withCredentials: true, | ||
| }); |
| const autoadmin_gclid_cookie = this.cookieService.get('autoadmin_gclid'); | ||
| request = request.clone({ | ||
| setHeaders: { | ||
| masterpwd: masterKey, | ||
| GCLID: autoadmin_gclid_cookie, | ||
| }, | ||
| withCredentials: true, | ||
| }); |
| const url = new URL(request.url, location.origin); | ||
| const isApiRequest = url.origin === location.origin || url.origin == 'https://app.rocketadmin.com'; | ||
|
|
||
| request = request.clone({ | ||
| url: this.normalizeURL(request.url, environment.apiRoot || this.config.baseURL, environment.saasURL), | ||
| setHeaders: { | ||
| GCLID: autoadmin_gclid_cookie, | ||
| }, | ||
| withCredentials: true, | ||
| }); | ||
|
|
||
| if (connectionID && !request.headers.has('masterpwd')) { | ||
| const masterKey = localStorage.getItem(`${connectionID}__masterKey`) || ''; | ||
| if (isApiRequest) { | ||
| const autoadmin_gclid_cookie = this.cookieService.get('autoadmin_gclid'); | ||
| request = request.clone({ | ||
| setHeaders: { | ||
| masterpwd: masterKey, | ||
| GCLID: autoadmin_gclid_cookie, | ||
| }, | ||
| withCredentials: true, | ||
| }); | ||
|
|
||
| if (connectionID && !request.headers.has('masterpwd')) { | ||
| const masterKey = localStorage.getItem(`${connectionID}__masterKey`) || ''; |
|
Warning Rate limit exceeded
To continue reviewing without waiting, purchase usage credits in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughTokenInterceptor's ChangesAPI Request Authentication Filtering
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary by CodeRabbit