From fc6b2ccb00a064f7be3fbc4cb24ff95b2dd8329b Mon Sep 17 00:00:00 2001
From: John Cowen <johncowen@users.noreply.github.com>
Date: Thu, 1 Sep 2022 18:15:06 +0100
Subject: [PATCH] ui: Use credentials for all HTTP API requests (#14343)

Adds withCredentials/credentials to all HTTP API requests.
---
 .changelog/14343.txt                              | 4 ++++
 ui/packages/consul-ui/app/services/client/http.js | 1 +
 ui/packages/consul-ui/app/utils/http/xhr.js       | 1 +
 3 files changed, 6 insertions(+)
 create mode 100644 .changelog/14343.txt

diff --git a/.changelog/14343.txt b/.changelog/14343.txt
new file mode 100644
index 000000000..94e7432b4
--- /dev/null
+++ b/.changelog/14343.txt
@@ -0,0 +1,4 @@
+```release-note:feature
+ui: Use withCredentials for all HTTP API requests
+```
+
diff --git a/ui/packages/consul-ui/app/services/client/http.js b/ui/packages/consul-ui/app/services/client/http.js
index 6d3659c22..9b7736501 100644
--- a/ui/packages/consul-ui/app/services/client/http.js
+++ b/ui/packages/consul-ui/app/services/client/http.js
@@ -210,6 +210,7 @@ export default class HttpService extends Service {
     return this.settings.findBySlug('token').then(token => {
       return fetch(`${path}`, {
         ...params,
+        credentials: 'include',
         headers: {
           'X-Consul-Token': typeof token.SecretID === 'undefined' ? '' : token.SecretID,
           ...params.headers,
diff --git a/ui/packages/consul-ui/app/utils/http/xhr.js b/ui/packages/consul-ui/app/utils/http/xhr.js
index cbdea6411..8ef24a019 100644
--- a/ui/packages/consul-ui/app/utils/http/xhr.js
+++ b/ui/packages/consul-ui/app/utils/http/xhr.js
@@ -27,6 +27,7 @@ export default function(parseHeaders, XHR) {
     };
     Object.entries(headers).forEach(([key, value]) => xhr.setRequestHeader(key, value));
     options.beforeSend(xhr);
+    xhr.withCredentials = true;
     xhr.send(options.body);
     return xhr;
   };