@bytescale/sdk 3.61.0 → 3.62.0

package/README.md

@@ -432,6 +432,97 @@ With JWTs, the user can also perform API requests, such as file deletions, as th
 
 [Learn more about the `AuthManager` and JWTs »](https://www.bytescale.com/docs/auth)
 
+### Authenticate private URL aliases while keeping public CDN requests cacheable
+
+Automatic (`AuthSessionConfigAuto`) and manual (`AuthSessionConfigManual`) configurations both accept
+`requestUrlPrefixes?: string[]`. This restricts **service-worker authentication** by matching the original
+`event.request.url`, before `urlRewriteRules` are applied. The rewritten destination must still match the
+configuration's CDN URL and account, and the configuration must not have expired.
+
+- Omit the field (or set it to `undefined`) to preserve existing behavior.
+- Set it to `[]` to authenticate no requests through the service worker.
+- Provide multiple prefixes to match any of them using case-sensitive `startsWith` comparisons.
+
+Prefixes follow the same string-array validation as `sourceUrlPrefixes`: they are not parsed or normalized.
+Use complete URL prefixes with a trailing `/` when restricting an origin or directory. An empty string matches
+any URL. `sourceUrlPrefixes` independently restricts the initiating page or iframe URL; when both fields are
+provided, both must match. Request prefixes alone do not require an initiating client, so new-tab downloads
+can use them.
+
+Serve the current Bytescale auth service worker as `/auth-sw.js` on your application's origin, then initialize
+an automatic configuration:
+
+```javascript
+import { AuthManager } from "@bytescale/sdk";
+
+await AuthManager.beginAuthSession({
+  serviceWorkerScript: "/auth-sw.js",
+  urlRewriteRules: [
+    { fromUrlPrefix: "https://app.example.com/media-auth/", toUrlPrefix: "https://upcdn.io/" },
+    { fromUrlPrefix: "https://app.example.com/download/", toUrlPrefix: "https://upcdn.io/" }
+  ],
+  authConfigs: async () => [
+    {
+      accountId: "A123abc", // Replace with your Bytescale account ID.
+      authConfigId: undefined,
+      authUrl: "https://app.example.com/auth", // Your endpoint returning a JWT as text/plain.
+      authHeaders: async () => ({}),
+      requestUrlPrefixes: ["https://app.example.com/media-auth/", "https://app.example.com/download/"],
+      enableCookieAuth: false
+    }
+  ]
+});
+```
+
+For a manual configuration, replace `authUrl` and `authHeaders` with your `getAuthorizationToken` callback;
+keep `requestUrlPrefixes` and the other fields:
+
+```javascript
+const manualConfig = {
+  accountId: "A123abc",
+  authConfigId: undefined,
+  requestUrlPrefixes: ["https://app.example.com/media-auth/", "https://app.example.com/download/"],
+  getAuthorizationToken: async () => {
+    const response = await fetch("/auth");
+    return await response.text();
+  }
+};
+```
+
+With the example configuration:
+
+| Original resource URL                                                    | Final destination                                        | AuthManager-injected headers |
+| ------------------------------------------------------------------------ | -------------------------------------------------------- | ---------------------------- |
+| `https://upcdn.io/A123abc/image/example.jpg`                             | Unchanged                                                | None                         |
+| `https://app.example.com/media-auth/A123abc/image/example.jpg`           | `https://upcdn.io/A123abc/image/example.jpg`             | Account A123abc's JWT        |
+| `https://app.example.com/download/A123abc/raw/example.jpg?download=true` | `https://upcdn.io/A123abc/raw/example.jpg?download=true` | Account A123abc's JWT        |
+| `https://app.example.com/media-auth/B123abc/image/example.jpg`           | `https://upcdn.io/B123abc/image/example.jpg`             | None                         |
+
+The download alias supports a normal link after initialization:
+
+```html
+<a href="https://app.example.com/download/A123abc/raw/example.jpg?download=true" target="_blank" rel="noopener">
+  Download
+</a>
+```
+
+Rewriting uses the first matching rule once and continues even when authentication does not match. Responses
+remain streamed, and range headers, query parameters, and navigation behavior are preserved. A rejected request
+restriction allows the worker to consider later authentication entries. Existing rules preventing duplicate
+service-worker destinations within an AuthManager session still apply.
+
+This field does not change API-client authentication, cookie authentication, token acquisition, or refresh.
+It does not remove caller-provided headers or existing CDN cookies. Leave cookie authentication disabled and
+avoid other broad authentication configurations for CDN requests you want to keep unauthenticated.
+
+**Compatibility and rollout:** deploy the auth worker shipped with SDK **3.62.0 or later** before enabling
+`requestUrlPrefixes` in the application. Update any self-hosted worker copies and allow the updated worker to
+activate in existing browser sessions. A distinct compatibility marker makes older workers skip the entire
+request-restricted configuration, even when `sourceUrlPrefixes` is also present. They cannot silently turn it
+into broad authentication. Private downloads may remain unauthenticated until the worker is updated; versions
+without rewrite support also cannot serve aliases. The updated worker can recover these restrictions and
+rewrite rules from persisted state after restart, and continues to support older configurations.
+
 ## UrlBuilder
 
 Use the `UrlBuilder` to construct URLs for your uploaded files:

package/dist/browser/cjs/main.js

@@ -3860,6 +3860,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     this.refreshBeforeExpirySeconds = 20;
     this.scheduler = new Scheduler();
     this.sourceScopedUrlPrefixMarker = "!bytescale-source-scoped!";
+    this.requestScopedUrlPrefixMarker = "!bytescale-request-scoped!";
     this.authSessionMutex = AuthSessionState.getMutex();
   }
   return AuthManagerBrowser_createClass(AuthManagerImpl, [{
@@ -4138,6 +4139,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
               key: "Authorization",
               value: "Bearer ".concat(state.jwt)
             }],
+            requestUrlPrefixes: state.config.requestUrlPrefixes,
             sourceUrlPrefixes: state.config.sourceUrlPrefixes,
             urlPrefix: "".concat(_this6.getConfigCdnUrl(session.params, state.config), "/").concat(state.config.accountId, "/")
           }];
@@ -4159,7 +4161,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           type: "SET_BYTESCALE_AUTH_CONFIG",
           config: config.map(function (entry) {
             return Object.assign(Object.assign({}, entry), {
-              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this7.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
+              urlPrefix: "".concat(entry.requestUrlPrefixes === undefined ? "" : _this7.requestScopedUrlPrefixMarker).concat(entry.sourceUrlPrefixes === undefined ? "" : _this7.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
             });
           })
         }, urlRewriteRules === undefined ? {} : {
@@ -4181,6 +4183,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           }
           return configs.map(function (config) {
             return config === null || AuthManagerBrowser_typeof(config) !== "object" ? config : Object.assign(Object.assign({}, config), {
+              requestUrlPrefixes: Array.isArray(config.requestUrlPrefixes) ? AuthManagerBrowser_toConsumableArray(config.requestUrlPrefixes) : config.requestUrlPrefixes,
               sourceUrlPrefixes: Array.isArray(config.sourceUrlPrefixes) ? AuthManagerBrowser_toConsumableArray(config.sourceUrlPrefixes) : config.sourceUrlPrefixes
             });
           });
@@ -4238,11 +4241,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (config.enableCookieAuth !== undefined && typeof config.enableCookieAuth !== "boolean" || config.enableServiceWorkerAuth !== undefined && typeof config.enableServiceWorkerAuth !== "boolean") {
             throw new Error("Authentication enablement flags must be booleans when provided.");
           }
-          if (config.sourceUrlPrefixes !== undefined && (!Array.isArray(config.sourceUrlPrefixes) || !config.sourceUrlPrefixes.every(function (prefix) {
-            return typeof prefix === "string";
-          }))) {
-            throw new Error("The 'sourceUrlPrefixes' field must be an array of strings.");
-          }
+          this.validateUrlPrefixes(config.sourceUrlPrefixes, "sourceUrlPrefixes");
+          this.validateUrlPrefixes(config.requestUrlPrefixes, "requestUrlPrefixes");
           var isManual = typeof config.getAuthorizationToken === "function";
           var isAutomatic = typeof config.authUrl === "string" && typeof config.authHeaders === "function";
           if (isManual === isAutomatic || isManual && (config.authUrl !== undefined || config.authHeaders !== undefined)) {
@@ -4284,6 +4284,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         }
       }
     }
+  }, {
+    key: "validateUrlPrefixes",
+    value: function validateUrlPrefixes(prefixes, fieldName) {
+      if (prefixes !== undefined && (!Array.isArray(prefixes) || !prefixes.every(function (prefix) {
+        return typeof prefix === "string";
+      }))) {
+        throw new Error("The '".concat(fieldName, "' field must be an array of strings."));
+      }
+    }
   }, {
     key: "validateUrlRewriteRules",
     value: function validateUrlRewriteRules(rules) {

package/dist/browser/esm/main.mjs

@@ -3820,6 +3820,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     this.refreshBeforeExpirySeconds = 20;
     this.scheduler = new Scheduler();
     this.sourceScopedUrlPrefixMarker = "!bytescale-source-scoped!";
+    this.requestScopedUrlPrefixMarker = "!bytescale-request-scoped!";
     this.authSessionMutex = AuthSessionState.getMutex();
   }
   return AuthManagerBrowser_createClass(AuthManagerImpl, [{
@@ -4098,6 +4099,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
               key: "Authorization",
               value: "Bearer ".concat(state.jwt)
             }],
+            requestUrlPrefixes: state.config.requestUrlPrefixes,
             sourceUrlPrefixes: state.config.sourceUrlPrefixes,
             urlPrefix: "".concat(_this6.getConfigCdnUrl(session.params, state.config), "/").concat(state.config.accountId, "/")
           }];
@@ -4119,7 +4121,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           type: "SET_BYTESCALE_AUTH_CONFIG",
           config: config.map(function (entry) {
             return Object.assign(Object.assign({}, entry), {
-              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this7.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
+              urlPrefix: "".concat(entry.requestUrlPrefixes === undefined ? "" : _this7.requestScopedUrlPrefixMarker).concat(entry.sourceUrlPrefixes === undefined ? "" : _this7.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
             });
           })
         }, urlRewriteRules === undefined ? {} : {
@@ -4141,6 +4143,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           }
           return configs.map(function (config) {
             return config === null || AuthManagerBrowser_typeof(config) !== "object" ? config : Object.assign(Object.assign({}, config), {
+              requestUrlPrefixes: Array.isArray(config.requestUrlPrefixes) ? AuthManagerBrowser_toConsumableArray(config.requestUrlPrefixes) : config.requestUrlPrefixes,
               sourceUrlPrefixes: Array.isArray(config.sourceUrlPrefixes) ? AuthManagerBrowser_toConsumableArray(config.sourceUrlPrefixes) : config.sourceUrlPrefixes
             });
           });
@@ -4198,11 +4201,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (config.enableCookieAuth !== undefined && typeof config.enableCookieAuth !== "boolean" || config.enableServiceWorkerAuth !== undefined && typeof config.enableServiceWorkerAuth !== "boolean") {
             throw new Error("Authentication enablement flags must be booleans when provided.");
           }
-          if (config.sourceUrlPrefixes !== undefined && (!Array.isArray(config.sourceUrlPrefixes) || !config.sourceUrlPrefixes.every(function (prefix) {
-            return typeof prefix === "string";
-          }))) {
-            throw new Error("The 'sourceUrlPrefixes' field must be an array of strings.");
-          }
+          this.validateUrlPrefixes(config.sourceUrlPrefixes, "sourceUrlPrefixes");
+          this.validateUrlPrefixes(config.requestUrlPrefixes, "requestUrlPrefixes");
           var isManual = typeof config.getAuthorizationToken === "function";
           var isAutomatic = typeof config.authUrl === "string" && typeof config.authHeaders === "function";
           if (isManual === isAutomatic || isManual && (config.authUrl !== undefined || config.authHeaders !== undefined)) {
@@ -4244,6 +4244,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         }
       }
     }
+  }, {
+    key: "validateUrlPrefixes",
+    value: function validateUrlPrefixes(prefixes, fieldName) {
+      if (prefixes !== undefined && (!Array.isArray(prefixes) || !prefixes.every(function (prefix) {
+        return typeof prefix === "string";
+      }))) {
+        throw new Error("The '".concat(fieldName, "' field must be an array of strings."));
+      }
+    }
   }, {
     key: "validateUrlRewriteRules",
     value: function validateUrlRewriteRules(rules) {

package/dist/types/private/dtos/AuthSwConfigEntryDto.d.ts

@@ -4,8 +4,10 @@ export interface AuthSwConfigEntryDto {
     expires: number | undefined;
     /** Headers to add to matching requests. */
     headers: AuthSwHeaderDto[];
+    /** Optional original resource URL prefixes, before rewriting. An empty array matches no requests. */
+    requestUrlPrefixes?: string[];
     /** Optional page or iframe URL prefixes. An empty array matches no clients. */
     sourceUrlPrefixes?: string[];
-    /** Request URL prefix. Use the actual URL; AuthManager applies any internal compatibility marker. */
+    /** Final destination URL prefix. Use the actual URL; AuthManager applies any internal compatibility marker. */
     urlPrefix: string;
 }

package/dist/types/private/model/AuthSessionConfigBase.d.ts

@@ -9,6 +9,14 @@ export interface AuthSessionConfigBase {
     enableCookieAuth?: boolean;
     /** Enables CDN service-worker authentication. Defaults to true. */
     enableServiceWorkerAuth?: boolean;
+    /**
+     * Restricts service-worker authentication to original resource URLs, before URL rewriting.
+     * Uses case-sensitive startsWith matching against any prefix. Undefined allows all requests; [] allows none.
+     * The final destination must still match this configuration's CDN and account.
+     * Does not affect API-client or cookie authentication, token acquisition, or refresh.
+     * Requires the auth service worker shipped with SDK 3.62.0 or later; older workers skip this config.
+     */
+    requestUrlPrefixes?: string[];
     /** Restricts service-worker authentication to matching page or iframe URLs. */
     sourceUrlPrefixes?: string[];
 }

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -16,6 +16,7 @@ declare class AuthManagerImpl implements AuthManagerInterface {
     private readonly refreshBeforeExpirySeconds;
     private readonly scheduler;
     private readonly sourceScopedUrlPrefixMarker;
+    private readonly requestScopedUrlPrefixMarker;
     constructor(serviceWorkerUtils: ServiceWorkerUtils<AuthSwSetConfigDto>);
     isAuthSessionActive(): boolean;
     isAuthSessionReady(): boolean;
@@ -28,6 +29,7 @@ declare class AuthManagerImpl implements AuthManagerInterface {
     private getV2Configs;
     private normalizeV1Config;
     private validateSessionConfig;
+    private validateUrlPrefixes;
     private validateUrlRewriteRules;
     private updateSessionState;
     private isConfigUsable;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.61.0",
+  "version": "3.62.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",

package/tests/ApiClientAuth.test.ts

@@ -60,6 +60,20 @@ describe("API-client AuthManager configuration", () => {
     expect(requestHeaders(fetchApi, 1).get("Authorization-Token")).toBe("access-refreshed");
   });
 
+  test.each(
+    [[], ["https://app.example.com/media-auth/"]].map((prefixes): { prefixes: typeof prefixes } => ({ prefixes }))
+  )("ignores service-worker request restrictions in API clients: $prefixes", async ({ prefixes }) => {
+    const configState = state(undefined, accountA, "jwt-a", "access-a");
+    configState.config.requestUrlPrefixes = prefixes;
+    setModernSession([configState]);
+    const withKey = createApi({ apiKey: apiKeyA });
+    const withoutKey = createApi({});
+    await withKey.api.get();
+    await withoutKey.api.get();
+    expect(requestHeaders(withKey.fetchApi).get("Authorization-Token")).toBe("access-a");
+    expect(requestHeaders(withoutKey.fetchApi).get("Authorization")).toBe("Bearer jwt-a");
+  });
+
   test("awaits manager-owned authentication at the expiry boundary", async () => {
     const configState = state("customer", accountA, "jwt-old", "access-old");
     configState.expiresAt = Date.now();

package/tests/AuthManagerBrowser.test.ts

@@ -4,11 +4,14 @@ import { AuthSessionState } from "../src/private/AuthSessionState";
 import { AuthSessionConfigState } from "../src/private/model/AuthSession";
 import type {
   AuthSessionConfig,
+  AuthSwConfigEntryDto,
   BeginAuthSessionParams,
   BeginAuthSessionParamsV2,
   UrlRewriteRule
 } from "../src/index.browser";
 
+import { AuthServiceWorkerHarness } from "./utils/AuthServiceWorkerHarness";
+
 type FetchApi = NonNullable<NonNullable<BeginAuthSessionParams["options"]>["fetchApi"]>;
 
 interface AuthManagerApi {
@@ -143,11 +146,13 @@ describe("AuthManager browser multi-configuration sessions", () => {
         authConfigId: undefined,
         authHeaders: async (): Promise<Record<string, string>> => ({ "X-App-Auth": "app-token" }),
         authUrl: "https://app.example.com/auth-a",
+        requestUrlPrefixes: ["https://app.example.com/media-auth/"],
         sourceUrlPrefixes: ["https://app.example.com/"]
       },
       {
         accountId: accountB,
         authConfigId: "customer-b",
+        requestUrlPrefixes: ["https://app.example.com/download/"],
         getAuthorizationToken: manualB
       },
       {
@@ -188,14 +193,16 @@ describe("AuthManager browser multi-configuration sessions", () => {
         {
           expires: expect.any(Number),
           headers: [{ key: "Authorization", value: `Bearer ${jwtA}` }],
+          requestUrlPrefixes: ["https://app.example.com/media-auth/"],
           sourceUrlPrefixes: ["https://app.example.com/"],
-          urlPrefix: `!bytescale-source-scoped!https://upcdn.io/${accountA}/`
+          urlPrefix: `!bytescale-request-scoped!!bytescale-source-scoped!https://upcdn.io/${accountA}/`
         },
         {
           expires: expect.any(Number),
           headers: [{ key: "Authorization", value: `Bearer ${jwtB}` }],
+          requestUrlPrefixes: ["https://app.example.com/download/"],
           sourceUrlPrefixes: undefined,
-          urlPrefix: `https://upcdn.io/${accountB}/`
+          urlPrefix: `!bytescale-request-scoped!https://upcdn.io/${accountB}/`
         }
       ],
       type: "SET_BYTESCALE_AUTH_CONFIG",
@@ -203,6 +210,94 @@ describe("AuthManager browser multi-configuration sessions", () => {
     });
   });
 
+  test.each(
+    [undefined, [], ["https://app.example.com/media-auth/", "https://app.example.com/download/"]].map(
+      (prefixes): { prefixes: typeof prefixes } => ({
+        prefixes
+      })
+    )
+  )("sends request prefixes through messages and restores them in the worker: $prefixes", async ({ prefixes }) => {
+    const fetchApi = createFetchApi();
+    await AuthManager.beginAuthSession({
+      authConfigs: async () => [
+        {
+          accountId: accountA,
+          authConfigId: undefined,
+          getAuthorizationToken: async () => jwtA,
+          requestUrlPrefixes: prefixes
+        }
+      ],
+      options: { fetchApi },
+      serviceWorkerScript: "/auth-sw.js",
+      urlRewriteRules: [{ fromUrlPrefix: "https://app.example.com/media-auth/", toUrlPrefix: "https://upcdn.io/" }]
+    });
+    const message = postMessage.mock.calls.at(-1)?.[0] as {
+      config: AuthSwConfigEntryDto[];
+      type: "SET_BYTESCALE_AUTH_CONFIG";
+      urlRewriteRules: UrlRewriteRule[];
+    };
+    expect(message.config[0].requestUrlPrefixes).toEqual(prefixes);
+    expect(message.config[0].urlPrefix).toBe(
+      `${prefixes === undefined ? "" : "!bytescale-request-scoped!"}https://upcdn.io/${accountA}/`
+    );
+    const worker = new AuthServiceWorkerHarness();
+    await worker.dispatchMessage(message);
+    const restarted = worker.restart();
+    const result = await restarted.dispatchFetch(`https://app.example.com/media-auth/${accountA}/image/example.jpg`);
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe(prefixes?.length === 0 ? null : `Bearer ${jwtA}`);
+    const direct = await restarted.dispatchFetch(`https://upcdn.io/${accountA}/image/example.jpg`);
+    expect(direct.responded).toBe(prefixes === undefined);
+  });
+
+  test("snapshots request prefixes and keeps them through token refresh", async () => {
+    const requestUrlPrefixes = ["https://app.example.com/media-auth/"];
+    const provider = jest.fn<() => Promise<string>>().mockResolvedValueOnce(jwtA).mockResolvedValueOnce(jwtB);
+    await AuthManager.beginAuthSession({
+      authConfigs: async () => [
+        { accountId: accountA, authConfigId: undefined, getAuthorizationToken: provider, requestUrlPrefixes }
+      ],
+      options: { fetchApi: createFetchApi() },
+      serviceWorkerScript: "/auth-sw.js"
+    });
+    requestUrlPrefixes.length = 0;
+    const session = AuthSessionState.getSession();
+    const state = session?.authConfigs?.[0];
+    if (session === undefined || state === undefined) {
+      throw new Error("Expected initialized auth state.");
+    }
+    await (AuthManager as AuthManagerInternals).refreshAuthConfig(session, state);
+    expect(provider).toHaveBeenCalledTimes(2);
+    expect(state.config.requestUrlPrefixes).toEqual(["https://app.example.com/media-auth/"]);
+    expect(state.refreshHandle).toBeDefined();
+    expect((postMessage.mock.calls.at(-1)?.[0] as { config: AuthSwConfigEntryDto[] }).config[0]).toMatchObject({
+      headers: [{ key: "Authorization", value: `Bearer ${jwtB}` }],
+      requestUrlPrefixes: ["https://app.example.com/media-auth/"]
+    });
+  });
+
+  test.each(
+    [null, "https://app.example.com/", [42], ["https://app.example.com/", null]].map(
+      (prefixes): { prefixes: typeof prefixes } => ({ prefixes })
+    )
+  )("rejects malformed request prefixes before acquiring tokens: $prefixes", async ({ prefixes }) => {
+    const provider = jest.fn(async () => jwtA);
+    const fetchApi = createFetchApi();
+    await expect(
+      AuthManager.beginAuthSession(
+        v2Params(fetchApi, [
+          {
+            ...apiOnlyConfig(undefined, accountA, provider),
+            requestUrlPrefixes: prefixes as unknown as string[]
+          }
+        ])
+      )
+    ).rejects.toThrow("The 'requestUrlPrefixes' field must be an array of strings.");
+    expect(provider).not.toHaveBeenCalled();
+    expect(fetchApi).not.toHaveBeenCalled();
+    expect(postMessage).not.toHaveBeenCalled();
+    expect(AuthManager.isAuthSessionActive()).toBe(false);
+  });
+
   test("uses each config's effective CDN URL for registration, worker prefixes, cleanup, and collisions", async () => {
     const fetchApi = createFetchApi();
     const defaultCdnUrl = "https://downloads-default.example.com";
@@ -269,6 +364,7 @@ describe("AuthManager browser multi-configuration sessions", () => {
           authConfigId: undefined,
           enableCookieAuth: true,
           enableServiceWorkerAuth: false,
+          requestUrlPrefixes: [],
           getAuthorizationToken: provider
         }
       ],