ServerCredentialsHttpTransport class final

An HttpTransport for a web app whose server is on another origin than the page: the browser's cookies go with the requests to that server only, never to another API.

A web app logged in by its server (backend-for-frontend) holds a session cookie; when the server is on another origin (the page at app.neon.books, the server at api.neon.books), fetch sends it only when asked (credentials: 'include'). Asking for every request would send the user's cookies to every API the app calls, and a public API that answers Access-Control-Allow-Origin: * then fails in the browser (credentials need a listed origin). So this transport decides per request: requests to server's origin go through serverTransport (FetchCredentials.include), all others through otherTransport (FetchCredentials.sameOrigin, the browser's default: cookies only for the page's own origin). Relative URLs are resolved against the page's address.

On the web, in server mode with the server on another origin, the package declares it inside the httpTransport bean (a CsrfCookieHttpTransport around it); with the server on the page's origin one transport with the default is enough. An application with its own HttpTransport bean builds it with ServerCredentialsHttpTransport.forPage:

@Bean()
HttpTransport httpTransport(BrowserPage page) {
  final server = Uri.parse('https://api.neon.books');
  return CsrfCookieHttpTransport(
    ServerCredentialsHttpTransport.forPage(page: page, server: server),
    page: page,
    server: server,
  );
}

Spring has no browser side; this is what a browser app does with fetch(url, {credentials: 'include'}) for its own API only.

Implemented types

Constructors

ServerCredentialsHttpTransport({required HttpTransport serverTransport, required HttpTransport otherTransport, required BrowserPage page, required Uri server})
Sends requests to server's origin through serverTransport and the others through otherTransport.
ServerCredentialsHttpTransport.forPage({required BrowserPage page, required Uri server, Duration? connectTimeout, HttpTransport create(FetchCredentials credentials)?})
A transport for the page at page and its server server: the browser's fetch with FetchCredentials.include for the server and FetchCredentials.sameOrigin for the rest (create makes them: platformHttpTransport with connectTimeout by default).
factory

Properties

hashCode → int
The hash code for this object.
no setterinherited
otherTransport → HttpTransport
The transport of every other request, which sends cookies to the page's own origin only.
final
page → BrowserPage
The page, against whose address relative URLs are resolved.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
server → Uri
The app's server.
final
serverTransport → HttpTransport
The transport of the requests to server's origin, which sends the cookies.
final

Methods

close() → void
Releases the transport's connections. Call it when the transport is no longer needed (the Feign starter does when the application stops); do not use the transport afterwards.
override
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
send(HttpRequest request) → Future<HttpResponse>
Sends request and reads the whole response into memory.
override
stream(HttpRequest request) → Future<StreamedHttpResponse>
Sends request and completes as soon as the status and headers have arrived. The body is then read from StreamedHttpResponse.body as it comes.
override
toString() → String
A string representation of this object.
inherited
transportFor(HttpRequest request) → HttpTransport
The transport request goes through.

Operators

operator ==(Object other) → bool
The equality operator.
inherited