@thunderid/browser 1.9.1 → 1.9.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer/index.js';
 if (typeof window !== 'undefined' && !window.Buffer) { window.Buffer = Buffer; }
-import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getTokenPermissions, getUsersMe, isEmojiUri, resolveBackendEndpoints, resolveResourceEndpoint } from "@thunderid/javascript";
+import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getTokenPermissions, getUsersMe, isEmojiUri, resolveApiBaseUrl, resolveBackendEndpoints, resolveResourceEndpoint } from "@thunderid/javascript";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
 import { createLocalJWKSet, jwtVerify } from "jose";
@@ -220,11 +220,12 @@ var BackendClient = class BackendClient {
 		return await response.json();
 	}
 	/**
-	* The headers and credentials mode every backend request is sent with.
+	* The headers and credentials mode every backend request is sent with. The cookies go with every
+	* request, so a backend on another origin works too when its CORS allows credentials.
 	*/
 	static requestInit(headers = {}) {
 		return {
-			credentials: "same-origin",
+			credentials: "include",
 			headers: {
 				...headers,
 				[BACKEND_REQUEST_HEADER]: BACKEND_REQUEST_HEADER_VALUE
@@ -3083,7 +3084,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		await this._validateMethod();
 		const configData = await this.getStorageManager().getConfigData();
 		const profile = await getUsersMe({
-			baseUrl: options?.baseUrl ?? configData?.baseUrl,
+			baseUrl: options?.baseUrl ?? resolveApiBaseUrl(configData),
 			fetcher: createHttpClientFetcher_default(this._browserInstanceId),
 			url: resolveResourceEndpoint("usersMe", configData, options?.url)
 		});