From db3b42ae7d9eecee9ab8300efa032bbf772423ef Mon Sep 17 00:00:00 2001 From: Ivan Starkov Date: Wed, 8 Mar 2023 13:49:54 +0400 Subject: [PATCH] Fix css on production You don't have access to this project (#1194) ## Description The issue it's the production bug only. In all other cases, session was used (same domain on canvas and on builder). closes #1159 ## Steps for reproduction 1. click button 2. expect xyz ## Code Review - [ ] hi @kof, I need you to do - conceptual review (architecture, feature-correctness) - detailed review (read every line) - test it on preview ## Before requesting a review - [ ] made a self-review - [ ] added inline comments where things may be not obvious (the "why", not "what") ## Before merging - [ ] tested locally and on preview environment (preview dev login: 5de6) - [ ] updated [test cases](https://github.com/webstudio-is/webstudio-builder/blob/main/apps/builder/docs/test-cases.md) document - [ ] added tests - [ ] if any new env variables are added, added them to `.env.example` and the `builder/env-check.js` if mandatory --- apps/builder/app/shared/context.server.ts | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/apps/builder/app/shared/context.server.ts b/apps/builder/app/shared/context.server.ts index 221acb33ec..49180ae7fe 100644 --- a/apps/builder/app/shared/context.server.ts +++ b/apps/builder/app/shared/context.server.ts @@ -15,7 +15,16 @@ const createAuthorizationContext = async ( request: Request, buildEnv: AppContext["authorization"]["buildEnv"] ): Promise => { - const url = new URL(request.url); + const originUrl = new URL(request.url); + let url = originUrl; + + // In case of css use referrer as url to extract tokens from canvas iframe href + if (originUrl.pathname === "/s/css") { + const referer = request.headers.get("referer"); + if (referer !== null) { + url = new URL(referer); + } + } const authReadTokenRaw = url.searchParams.get("authReadToken") ?? undefined; const authToken = url.searchParams.get("authToken") ?? url.hostname;