Skip to content

Include credentials when making request to action /secrets#1882

Merged
dandelany merged 4 commits intodevelopfrom
feat/include-credentials-for-actions-secrets
Feb 25, 2026
Merged

Include credentials when making request to action /secrets#1882
dandelany merged 4 commits intodevelopfrom
feat/include-credentials-for-actions-secrets

Conversation

@AaronPlave
Copy link
Copy Markdown
Contributor

@AaronPlave AaronPlave commented Feb 20, 2026

___REQUIRES_AERIE_PR___="1784"

Include cookie credentials when making a request to the secrets endpoint of the action server to support forwarding of cookies (including httpOnly cookies) that may be required by actions for external authentication purposes.

Credential inclusion is gated behind a new PUBLIC_ACTION_INCLUDE_CREDENTIALS environment variable (default false). When set to true, the UI sends credentials: 'include' on action server requests, allowing the browser to attach cookies. This is opt-in to avoid breaking cross-origin deployments that don't have ACTION_CORS_ALLOWED_ORIGIN configured on the action server.

See backend PR for more details and testing procedure.

Copy link
Copy Markdown
Collaborator

@duranb duranb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you mind updating the test.yml file as well to include the new env vars?

@AaronPlave
Copy link
Copy Markdown
Contributor Author

Do you mind updating the test.yml file as well to include the new env vars?

Done. So many updates required for env var additions..

@duranb
Copy link
Copy Markdown
Collaborator

duranb commented Feb 23, 2026

Do you mind updating the test.yml file as well to include the new env vars?

Done. So many updates required for env var additions..

Thanks! I know...

@dandelany dandelany force-pushed the feat/include-credentials-for-actions-secrets branch from c88edeb to 5590714 Compare February 25, 2026 01:00
Copy link
Copy Markdown
Collaborator

@duranb duranb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

@dandelany dandelany merged commit 93eefea into develop Feb 25, 2026
5 checks passed
@dandelany dandelany deleted the feat/include-credentials-for-actions-secrets branch February 25, 2026 19:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants