Add support to set withCredentials on ahoy config

[gualopezb]

This option is required on ajax requests to send credentials such as cookies, authorization headers or TLS client certificates from a different domain

[ankane]

Hey @gualopezb, thanks for the PR 👍 and sorry for the delay. I think it'd be good to document this feature in the readme, including the security implications.

[gualopezb]

@ankane I just documented this feature in the readme: edf4acb

[ankane]

Thanks @gualopezb 👍 I'll test this out once things are in a good place for the 1.0 release. Will see if I can include it there (otherwise, a release shortly after).

[ankane]

Hey @gualopezb, can you explain more about your setup for cross-domain tracking? (where cookies are set, etc?)

Also, looks like the option was only added to jQuery. Can you add it to non-jQuery AJAX requests? From what I can tell, navigator.sendBeacon (the new default) doesn't support this, so we probably need to switch to AJAX if the option is set.

[gualopezb]

@ankane sure, I can add more details about the setup for cross-domain tracking. Do you mean improve the documentation in the README, right?

Regarding the non-jQuery AJAX requests, I think we can use the fetch API with keepalive flag set to true instead of navigator.sendBeacon, so we'd have the ability to customize the request and therefore send cookies. We have to check the current support of this flag from the browsers.

[gualopezb]

@ankane according to the fetch spec, a request has an associated keepalive flag:

This can be used to allow the request to outlive the environment settings object, e.g., navigator.sendBeacon and the HTML img element set this flag. Requests with this flag set are subject to additional processing requirements.

I was trying to make a request using this option set, and including the credentials option set to "include" as well. However I got the following error:

Preflight request for request with keepalive specified is currently not supported

So we definitely would need to make AJAX requests when the option crossDomain is set to true in the ahoy config.

[gualopezb]

@ankane I renamed the crossDomain option to withCredentials taking as inspiration the axios documentation. I also made a change on the canTrackNow function to not track now events by using navigator.sendBeacon when the option withCredentials is set, and finally I updated the readme. I tested it out and it worked very well for me. I guess this PR is ready to be merged.

[kieranklaassen]

👍 great addition

[ankane]

Merged, thanks @gualopezb 👍