Files
gochat/frontend/app/javascript/dashboard/helper/APIHelper.js
T
Rogeeandrogee f719529d66 fix(security): harden auth and secret handling (HH-444) (#101)
* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>
2026-08-22 15:45:06 +08:00

49 lines
1.3 KiB
JavaScript

import Auth from '../api/auth';
const parseErrorCode = error => Promise.reject(error);
const AUTH_HEADERS = ['access-token', 'token-type', 'client', 'expiry', 'uid'];
export default axios => {
const { apiHost = '' } = window.chatwootConfig || {};
const wootApi = axios.create({
baseURL: `${apiHost}/`,
withCredentials: true,
});
const authHeaders = {};
let refreshRequest;
wootApi.interceptors.request.use(config => {
Object.assign(config.headers, authHeaders);
return config;
});
wootApi.interceptors.response.use(
response => {
AUTH_HEADERS.forEach(header => {
if (response.headers?.[header])
authHeaders[header] = response.headers[header];
});
return response;
},
async error => {
const request = error.config;
if (
error.response?.status !== 401 ||
request?._retry ||
request?._sessionRefresh ||
!Auth.hasAuthCookie()
) {
return parseErrorCode(error);
}
request._retry = true;
refreshRequest ||= wootApi
.get('/auth/validate_token', { _sessionRefresh: true })
.finally(() => {
refreshRequest = null;
});
await refreshRequest;
return wootApi(request);
}
);
return wootApi;
};