@salesforce/commerce-sdk-react 5.3.0-preview.0 → 5.3.0

package/CHANGELOG.md

@@ -1,4 +1,5 @@
-## v5.3.0-preview.0
+## v5.3.0 (Jul 13, 2026)
+- [Bugfix] Fix Storefront Preview session loss with HttpOnly session cookies enabled. When the storefront runs inside a trusted Storefront Preview iframe, the client now sends the trusted parent origin as an `x-pwakit-preview-parent` header on the SLAS token request so the BFF sets session cookies with `SameSite=None; Partitioned`. Because the token request is never CDN-cached, this signal reaches the origin reliably even when the cacheable iframe document load is served from cache and bypasses the server-set preview marker cookie; the origin re-validates the value against its allow-list.
 - [Bugfix] Fix stale `sfdc_dwsid` server-affinity header in `CommerceApiProvider`. The `updatedClients` `useMemo` baked the `dwsid`-derived header into each SCAPI client's config but omitted `dwsid` from its dependency array, so when only the `dwsid` cookie changed (guest-to-login, session bridge, re-auth) the memoized clients kept sending the stale header, risking wrong/expired app-server routing on hybrid storefronts. The `dwsid` primitive is now a dependency so clients rebuild on change without churning on unrelated renders.
 - [Feature] Add OMS order-action hooks for Shopper Orders: the `cancelOmsOrder` and `returnOmsOrder` mutations and the `getOmsMetaData` query hook (return/cancel reason codes), with cache invalidation on the mutating actions. [#3864](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3864) [#3869](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3869)
 - Bump `commerce-sdk-isomorphic` to `5.4.0`, the first stable release carrying the OMS Shopper Orders endpoints (`oms-return-order`, `oms-cancel-order`, `oms-meta-data`).

package/auth/index.js

@@ -213,6 +213,21 @@ class Auth {
         credentials: 'same-origin'
       }, config.fetchOptions)
     });
+
+    // When HttpOnly session cookies are enabled and the storefront is
+    // running inside a trusted Storefront Preview iframe, signal the parent
+    // origin to the BFF so it sets session cookies with SameSite=None;
+    // Partitioned (required for the cross-site iframe). This rides on the
+    // SLAS token POST — which is never CDN-cached — so it always reaches
+    // the origin, unlike the server-set `__Host-pwakit_preview_ctx` marker
+    // cookie that depends on the (cacheable) iframe document load hitting
+    // the origin. The BFF re-validates the value against its allow-list.
+    if (config.enableHttpOnlySessionCookies) {
+      const previewParentOrigin = (0, _utils.getTrustedPreviewParentOrigin)();
+      if (previewParentOrigin) {
+        this.client.clientConfig.headers[_constant.X_PREVIEW_PARENT] = previewParentOrigin;
+      }
+    }
     this.shopperCustomersClient = new _commerceSdkIsomorphic.ShopperCustomers({
       proxy: config.proxy,
       headers: config.headers || {},

package/constant.d.ts

@@ -21,6 +21,7 @@ export declare const EXCLUDE_COOKIE_SUFFIX: string[];
  */
 export declare const SERVER_AFFINITY_HEADER_KEY = "sfdc_dwsid";
 export declare const X_GRANT_TYPE = "x-grant-type";
+export declare const X_PREVIEW_PARENT = "x-pwakit-preview-parent";
 export declare const CLIENT_KEYS: {
     readonly SHOPPER_BASKETS: "shopperBaskets";
     readonly SHOPPER_BASKETS_V2: "shopperBasketsV2";

package/constant.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.X_GRANT_TYPE = exports.SLAS_SECRET_WARNING_MSG = exports.SLAS_SECRET_PLACEHOLDER = exports.SLAS_SECRET_OVERRIDE_MSG = exports.SLAS_REFRESH_TOKEN_COOKIE_TTL_OVERRIDE_MSG = exports.SERVER_AFFINITY_HEADER_KEY = exports.IFRAME_HOST_ALLOW_LIST = exports.EXCLUDE_COOKIE_SUFFIX = exports.DWSID_COOKIE_NAME = exports.DNT_COOKIE_NAME = exports.CLIENT_KEYS = void 0;
+exports.X_PREVIEW_PARENT = exports.X_GRANT_TYPE = exports.SLAS_SECRET_WARNING_MSG = exports.SLAS_SECRET_PLACEHOLDER = exports.SLAS_SECRET_OVERRIDE_MSG = exports.SLAS_REFRESH_TOKEN_COOKIE_TTL_OVERRIDE_MSG = exports.SERVER_AFFINITY_HEADER_KEY = exports.IFRAME_HOST_ALLOW_LIST = exports.EXCLUDE_COOKIE_SUFFIX = exports.DWSID_COOKIE_NAME = exports.DNT_COOKIE_NAME = exports.CLIENT_KEYS = void 0;
 /*
  * Copyright (c) 2025, Salesforce, Inc.
  * All rights reserved.
@@ -39,6 +39,17 @@ const SERVER_AFFINITY_HEADER_KEY = exports.SERVER_AFFINITY_HEADER_KEY = 'sfdc_dw
 
 // Custom header sent by the SDK to signal a refresh token request to the proxy.
 const X_GRANT_TYPE = exports.X_GRANT_TYPE = 'x-grant-type';
+
+// Custom header sent by the SDK on SLAS token requests when the storefront is
+// running inside a trusted Storefront Preview iframe. Carries the (trusted)
+// parent origin so the BFF can set session cookies with SameSite=None;
+// Partitioned instead of SameSite=Lax. Sent only when HttpOnly session cookies
+// are enabled. Unlike the server-set `__Host-pwakit_preview_ctx` marker cookie
+// (which relies on the iframe document load reaching the origin, and so is
+// bypassed when that response is served from the CDN cache), this header rides
+// on the non-cacheable token POST and always reaches the origin. The BFF
+// re-validates the value against its own allow-list before honoring it.
+const X_PREVIEW_PARENT = exports.X_PREVIEW_PARENT = 'x-pwakit-preview-parent';
 const CLIENT_KEYS = exports.CLIENT_KEYS = {
   SHOPPER_BASKETS: 'shopperBaskets',
   SHOPPER_BASKETS_V2: 'shopperBasketsV2',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/commerce-sdk-react",
-  "version": "5.3.0-preview.0",
+  "version": "5.3.0",
   "description": "A library that provides react hooks for fetching data from Commerce Cloud",
   "homepage": "https://github.com/SalesforceCommerceCloud/pwa-kit/tree/develop/packages/ecom-react-hooks#readme",
   "bugs": {
@@ -46,7 +46,7 @@
     "jwt-decode": "^4.0.0"
   },
   "devDependencies": {
-    "@salesforce/pwa-kit-dev": "3.19.0-preview.0",
+    "@salesforce/pwa-kit-dev": "3.19.0",
     "@tanstack/react-query": "^4.28.0",
     "@testing-library/jest-dom": "^5.16.5",
     "@testing-library/react": "^14.0.0",
@@ -61,7 +61,7 @@
     "@types/react-helmet": "~6.1.6",
     "@types/react-router-dom": "~5.3.3",
     "cross-env": "^5.2.1",
-    "internal-lib-build": "3.19.0-preview.0",
+    "internal-lib-build": "3.19.0",
     "jsonwebtoken": "^9.0.0",
     "nock": "^13.3.0",
     "nodemon": "^2.0.22",
@@ -98,5 +98,5 @@
   "publishConfig": {
     "directory": "dist"
   },
-  "gitHead": "f93e393e81306cfc61186f9162324f7ff8ac7b3c"
+  "gitHead": "5192e11826187be0dbdacf4754c84ac18af64f67"
 }

package/utils.d.ts

@@ -37,6 +37,19 @@ export declare const isOriginTrusted: (origin: string | undefined) => boolean;
  * (i.e. Storefront Preview), otherwise `"Lax"`
  */
 export declare const getCookieSameSiteAttribute: () => "none" | "Lax" | undefined;
+/**
+ * Returns the parent origin when the storefront is running inside a trusted
+ * Storefront Preview iframe (i.e. the same condition under which
+ * `getCookieSameSiteAttribute` returns `"none"`), otherwise `undefined`.
+ *
+ * Used to signal the trusted parent origin to the BFF (via the
+ * `x-pwakit-preview-parent` header) on SLAS token requests when HttpOnly
+ * session cookies are enabled, so the server can set session cookies with
+ * SameSite=None; Partitioned. Returns `undefined` on the server and on
+ * localhost (the server-side allow-list does not include the local dev
+ * origin, and local dev is not fronted by the CDN that motivates this header).
+ */
+export declare const getTrustedPreviewParentOrigin: () => string | undefined;
 /**
  * Gets the default cookie attributes. Sets the secure flag unless running on localhost in Safari.
  * Sets the sameSite attribute to `"none"` when running in a trusted iframe.

package/utils.js

@@ -7,7 +7,7 @@ exports.DEVELOPMENT_ORIGIN = void 0;
 exports.detectCookiesAvailable = detectCookiesAvailable;
 exports.detectInIframe = void 0;
 exports.detectLocalStorageAvailable = detectLocalStorageAvailable;
-exports.getParentOrigin = exports.getDefaultCookieAttributes = exports.getCookieSameSiteAttribute = exports.extractCustomParameters = void 0;
+exports.getTrustedPreviewParentOrigin = exports.getParentOrigin = exports.getDefaultCookieAttributes = exports.getCookieSameSiteAttribute = exports.extractCustomParameters = void 0;
 exports.isAbsoluteUrl = isAbsoluteUrl;
 exports.transformSDKClient = exports.stringToBase64 = exports.parseResponseBodyClone = exports.onClient = exports.isOriginTrusted = void 0;
 var _jsCookie = _interopRequireDefault(require("js-cookie"));
@@ -96,11 +96,31 @@ const getCookieSameSiteAttribute = () => {
   return !isLocalHost && isOriginTrusted(parentOrigin) ? 'none' : 'Lax';
 };
 
+/**
+ * Returns the parent origin when the storefront is running inside a trusted
+ * Storefront Preview iframe (i.e. the same condition under which
+ * `getCookieSameSiteAttribute` returns `"none"`), otherwise `undefined`.
+ *
+ * Used to signal the trusted parent origin to the BFF (via the
+ * `x-pwakit-preview-parent` header) on SLAS token requests when HttpOnly
+ * session cookies are enabled, so the server can set session cookies with
+ * SameSite=None; Partitioned. Returns `undefined` on the server and on
+ * localhost (the server-side allow-list does not include the local dev
+ * origin, and local dev is not fronted by the CDN that motivates this header).
+ */
+exports.getCookieSameSiteAttribute = getCookieSameSiteAttribute;
+const getTrustedPreviewParentOrigin = () => {
+  if (!onClient()) return undefined;
+  const isLocalHost = window.location.hostname === 'localhost';
+  const parentOrigin = getParentOrigin();
+  return !isLocalHost && isOriginTrusted(parentOrigin) ? parentOrigin : undefined;
+};
+
 /**
  * Gets the default cookie attributes. Sets the secure flag unless running on localhost in Safari.
  * Sets the sameSite attribute to `"none"` when running in a trusted iframe.
  */
-exports.getCookieSameSiteAttribute = getCookieSameSiteAttribute;
+exports.getTrustedPreviewParentOrigin = getTrustedPreviewParentOrigin;
 const getDefaultCookieAttributes = () => {
   return {
     // Deployed sites will always be HTTPS, but the local dev server is served over HTTP.