Allow alternative Access-Control-Allow-Credentials values (close snowplow#808)

Co-authored-by: Mitch Pierias <mitchell.pierias@dominos.com.au>

Author: 2 people

common/changes/@snowplow/browser-tracker-core/issue-808_2021-12-21-20-04.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@snowplow/browser-tracker-core",
+      "comment": "Allow alternative Access-Control-Allow-Credentials values (#808)",
+      "type": "none"
+    }
+  ],
+  "packageName": "@snowplow/browser-tracker-core"
+}

common/changes/@snowplow/browser-tracker/issue-808_2021-12-21-20-04.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@snowplow/browser-tracker",
+      "comment": "Allow alternative Access-Control-Allow-Credentials values (#808)",
+      "type": "none"
+    }
+  ],
+  "packageName": "@snowplow/browser-tracker"
+}

common/changes/@snowplow/javascript-tracker/issue-808_2021-12-21-20-04.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@snowplow/javascript-tracker",
+      "comment": "Allow alternative Access-Control-Allow-Credentials values (#808)",
+      "type": "none"
+    }
+  ],
+  "packageName": "@snowplow/javascript-tracker"
+}

libraries/browser-tracker-core/src/tracker/index.ts

@@ -262,7 +262,8 @@ export function Tracker(
         trackerConfiguration.maxLocalStorageQueueSize ?? 1000,
         trackerConfiguration.connectionTimeout ?? 5000,
         configAnonymousServerTracking,
-        trackerConfiguration.customHeaders ?? {}
+        trackerConfiguration.customHeaders ?? {},
+        trackerConfiguration.withCredentials ?? true
       ),
       // Whether pageViewId should be regenerated after each trackPageView. Affect web_page context
       preservePageViewId = false,

libraries/browser-tracker-core/src/tracker/out_queue.ts

@@ -57,6 +57,8 @@ export interface OutQueue {
  * @param maxLocalStorageQueueSize - Maximum number of queued events we will attempt to store in local storage
  * @param connectionTimeout - Defines how long to wait before aborting the request
  * @param anonymousTracking - Defines whether to set the SP-Anonymous header for anonymous tracking on GET and POST
+ * @param customHeaders - Allows custom headers to be defined and passed on XMLHttpRequest requests
+ * @param withCredentials - Sets the value of the withCredentials flag on XMLHttpRequest (GET and POST) requests
  * @returns object OutQueueManager instance
  */
 export function OutQueueManager(
@@ -71,7 +73,8 @@ export function OutQueueManager(
   maxLocalStorageQueueSize: number,
   connectionTimeout: number,
   anonymousTracking: boolean,
-  customHeaders: Record<string, string>
+  customHeaders: Record<string, string>,
+  withCredentials: boolean
 ): OutQueue {
   type PostEvent = {
     evt: Record<string, unknown>;
@@ -405,7 +408,7 @@ export function OutQueueManager(
     } else {
       xhr.open('GET', url, !sync);
     }
-    xhr.withCredentials = true;
+    xhr.withCredentials = withCredentials;
     if (anonymousTracking) {
       xhr.setRequestHeader('SP-Anonymous', '*');
     }

libraries/browser-tracker-core/src/tracker/types.ts

@@ -92,6 +92,12 @@ export type TrackerConfiguration = {
    * @defaultValue 63072000 (2 years)
    */
   cookieLifetime?: number;
+  /**
+   * Sets the value of the withCredentials flag
+   * on XMLHttpRequest (GET and POST) requests
+   * @defaultValue true
+   */
+  withCredentials?: boolean;
   /**
    * How long until a session expires
    * @defaultValue 1800 (30 minutes)

libraries/browser-tracker-core/test/out_queue.test.ts

@@ -51,7 +51,8 @@ describe('OutQueueManager', () => {
       maxQueueSize,
       5000,
       false,
-      {}
+      {},
+      true
     );
   });
 

trackers/browser-tracker/docs/browser-tracker.api.md

@@ -311,6 +311,7 @@ export type TrackerConfiguration = {
     cookieSameSite?: CookieSameSite;
     cookieSecure?: boolean;
     cookieLifetime?: number;
+    withCredentials?: boolean;
     sessionCookieTimeout?: number;
     appId?: string;
     platform?: Platform;