Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-09-07 17:45:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #996 from Tria-plc/freight/fix/auth-separation

Browse Source 
feat(auth): add login audience middleware (EDRFREIGHT-415)
This commit is contained in:
Nathnael Wondisha
2026-07-28 13:52:42 +03:00
committed by GitHub
parent 3e828d3a3b e823874d39
commit 8309483d8f
12 changed files with 216 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
apps/edr-freight-web/backoffice/src/auth/http.ts
View File

@@ -76,6 +76,10 @@ api.interceptors.request.use((config) => {
config.headers.Authorization = `Bearer ${token}`;
}
// Tells the backend which app is asking, so /auth/login can reject
// cross-audience credentials (EDRFREIGHT-415).
config.headers["X-Client-App"] = "backoffice";
return config;
});

3
apps/edr-freight-web/backoffice/src/shared/services/axiosInstance.ts
View File

@@ -25,6 +25,9 @@ axiosInstance.interceptors.request.use((config) => {
}
// X-Requested-With prevents CSRF via browser-native form/fetch without custom headers
config.headers["X-Requested-With"] = "XMLHttpRequest";
// Tells the backend which app is asking, so /auth/login can reject
// cross-audience credentials (EDRFREIGHT-415).
config.headers["X-Client-App"] = "backoffice";
return config;
});