feat: support for with-credentials xhr flag

[n3squik]

Add support for xhr's with-credential flag (specs).

A new optional parameter is added to clients constructors. If not set the default value is false, so it does not change the prior behavior.

Usage:

const WITH_CREDENTIALS = true;
const client = new SomeServiceClient('https://www.some-domain.com:8443', WITH_CREDENTIALS);

Related issues: #176, #351

[jmzwcn]

seems this flag is unnecessary, give your credentials-value is enough directly.

[n3squik]

seems this flag is unnecessary, give your credentials-value is enough directly.

@jmzwcn could you elaborate a bit? where can I pass my credentials-value directly?

[stanley-cheung]

This is necessary. The xhr.with-credentials flag has special meaning in the browser, which will include domain cookies to be attached to the request. We just never got around to adding an API for it.

[jmzwcn]

Hope to avoid non-compatible and reduce too many parameters to easily use.

[stanley-cheung]

@n3squik Thanks for your contributions. I might have to think about this a little more, especially around how exactly we are gonna do this. For the internal use case, we don't have the extra credentials parameter in the constructor. We tried to detect whether certain metadata is being set and that indicates that we also want to .setWithCredentials(true).

The challenge in here (the open-source use case) is that it's hard to define what that condition might be. We might have to do it with setting a specific parameter in the options parameter in the constructor. I really want to avoid adding another parameter the stub client constructor without an absolutely necessary reason.

Let's keep this PR open - I will come back on this asap.

[andrewtikhonov]

withCredentials: true is needed for browsers to trigger authentication as a result of XMLHttprequest. If not set, the browser is silent. Currently it's not possible to properly trigger any browser driven auth as a result of gRPC call, neither Negotiate (NTLM, Kerberos) nor Basic.

Something like below should be enough if you don't want to change the arguments.

    if (options.withCredentials) {
        xhrIo.setWithCredentials(true);
    }

[Kupstas]

Any new information?

[AaronTriplett]

Checking in on this, currently blocked. Any chance we can get this merged?

[stanley-cheung]

Done in #604. Thanks for your contributions anyways. Sorry for the huge delay.

[stanley-cheung]

Before cutting the next release, is it possible that someone can verify if this works for your use case?

var client = new EchoServiceClient('localhost', null, {
  'withCredentials': true
});

I received a report that even with #604, cookie is not being attached to a cross-domain request. So I was wondering if we are still missing something.