Skip to content

token interceptor: send extra headers only on RA requests#1761

Merged
lyubov-voloshko merged 2 commits into
mainfrom
s3-bucket-providers
May 7, 2026
Merged

token interceptor: send extra headers only on RA requests#1761
lyubov-voloshko merged 2 commits into
mainfrom
s3-bucket-providers

Conversation

@lyubov-voloshko
Copy link
Copy Markdown
Collaborator

@lyubov-voloshko lyubov-voloshko commented May 7, 2026

Summary by CodeRabbit

  • Bug Fixes
    • Improved security by restricting authentication header application to API requests only.
    • Enhanced master password token handling to prevent duplicate headers.

Copilot AI review requested due to automatic review settings May 7, 2026 15:14
@lyubov-voloshko lyubov-voloshko enabled auto-merge May 7, 2026 15:15
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Angular TokenInterceptor to avoid attaching RocketAdmin-specific headers/credentials to non-RocketAdmin HTTP requests.

Changes:

  • Adds URL-origin detection to decide when to attach withCredentials and extra headers.
  • Moves GCLID / masterpwd header injection behind an isApiRequest condition.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +39 to 44
const url = new URL(request.url, location.origin);
const isApiRequest = url.origin === location.origin || url.origin == 'https://app.rocketadmin.com';

request = request.clone({
url: this.normalizeURL(request.url, environment.apiRoot || this.config.baseURL, environment.saasURL),
setHeaders: {
GCLID: autoadmin_gclid_cookie,
},
withCredentials: true,
});
Comment on lines +47 to 53
const autoadmin_gclid_cookie = this.cookieService.get('autoadmin_gclid');
request = request.clone({
setHeaders: {
masterpwd: masterKey,
GCLID: autoadmin_gclid_cookie,
},
withCredentials: true,
});
Comment on lines +39 to +56
const url = new URL(request.url, location.origin);
const isApiRequest = url.origin === location.origin || url.origin == 'https://app.rocketadmin.com';

request = request.clone({
url: this.normalizeURL(request.url, environment.apiRoot || this.config.baseURL, environment.saasURL),
setHeaders: {
GCLID: autoadmin_gclid_cookie,
},
withCredentials: true,
});

if (connectionID && !request.headers.has('masterpwd')) {
const masterKey = localStorage.getItem(`${connectionID}__masterKey`) || '';
if (isApiRequest) {
const autoadmin_gclid_cookie = this.cookieService.get('autoadmin_gclid');
request = request.clone({
setHeaders: {
masterpwd: masterKey,
GCLID: autoadmin_gclid_cookie,
},
withCredentials: true,
});

if (connectionID && !request.headers.has('masterpwd')) {
const masterKey = localStorage.getItem(`${connectionID}__masterKey`) || '';
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 7, 2026

Review Change Stack

Warning

Rate limit exceeded

@lyubov-voloshko has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 53 minutes and 1 second before requesting another review.

To continue reviewing without waiting, purchase usage credits in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8175c3de-ab32-465b-a106-3add8cea037b

📥 Commits

Reviewing files that changed from the base of the PR and between b08fd0b and bbcaccf.

📒 Files selected for processing (1)
  • frontend/src/app/services/token.interceptor.ts
📝 Walkthrough

Walkthrough

TokenInterceptor's intercept() method now classifies outgoing requests as API calls based on URL origin, then conditionally applies authentication headers (GCLID, withCredentials, masterpwd) exclusively to API requests instead of all requests. Error handling logic remains unchanged.

Changes

API Request Authentication Filtering

Layer / File(s) Summary
API Request Classification
frontend/src/app/services/token.interceptor.ts
The intercept() method computes connectionID, parses request.url into an absolute URL, and determines isApiRequest based on same-origin or specific production origin matching.
Conditional Auth Header Attachment
frontend/src/app/services/token.interceptor.ts
Within the isApiRequest guard, attaches autoadmin_gclid cookie as GCLID header, enables withCredentials, and conditionally adds masterpwd from localStorage for the current connection when not already present.
Error Handling Pipeline
frontend/src/app/services/token.interceptor.ts
HTTP 401 responses redirect to /login and rethrow the error; error path remains unchanged.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A token hops through requests with care,
Now checking origins with a clever stare—
API calls get credentials, others pass by,
Security guards the perimeter, way up high! 🔐

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch s3-bucket-providers

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@lyubov-voloshko lyubov-voloshko merged commit a878e4f into main May 7, 2026
13 of 14 checks passed
@lyubov-voloshko lyubov-voloshko deleted the s3-bucket-providers branch May 7, 2026 15:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants