@pagamio/frontend-commons-lib 0.8.290 → 0.8.291

package/lib/api/client.js

@@ -11,7 +11,7 @@ export class ApiClient {
             defaultHeaders: {
                 'Content-Type': 'application/json',
             },
-            credentials: 'include',
+            credentials: 'same-origin',
             ...config,
         };
     }

package/lib/auth/utils/TokenManager.js

@@ -60,13 +60,13 @@ export class TokenManager {
     }
     async refreshTokens() {
         try {
-            // The refresh token is stored as an httpOnly cookie and cannot be read
-            // by JS. We send `credentials: 'include'` so the browser attaches it
-            // automatically, and `x-origin-web` so the backend reads from cookies.
+            // The refresh token is stored as an httpOnly cookie by the backend.
+            // Requests go through the same-origin proxy so cookies are first-party
+            // and sent automatically with credentials: 'same-origin'.
             const oldRefreshToken = this.getRefreshToken();
             const response = await fetch(`${this.baseUrl}${this.refreshEndpoint}`, {
                 method: 'POST',
-                credentials: 'include',
+                credentials: 'same-origin',
                 headers: {
                     'Content-Type': 'application/json',
                     'x-origin-web': 'web-client',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pagamio/frontend-commons-lib",
   "description": "Pagamio library for Frontend reusable components like the form engine and table container",
-  "version": "0.8.290",
+  "version": "0.8.291",
   "publishConfig": {
     "access": "public",
     "provenance": false