Pair the example's scheme with the dev server's - #107
Merged
Conversation
`http://localhost` and `https://localhost` are two sites to a cookie, so the example as it stood could not sign in. Records the rule beside the API base.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.env.exampleshippedVITE_APP_API_BASE_URL=https://localhost:7004besideVITE_DOTNET_CERT=false— a page over HTTP against an API over HTTPS.A browser counts
http://localhostandhttps://localhostas two differentsites, and the session cookie is
SameSite=Lax, so a developer who copied thefile could not sign in:
POST /identity/loginanswers 200 and sends aSet-Cookie, the browser stores nothing, the next call is 401, and thescreen stays on the login form with no error anywhere.
Points it at
http://localhost:5171, which the Server's own launch profileserves beside 7004, and says at both variables that the schemes have to agree.
The port never mattered — only the scheme and the host.
Also records in
CLAUDE.md, beside the existing note about/api/v1, that adifferent origin is fine and a different site is not, and that a file is
reached by
fileApi.url(fileId)rather than by an address the Server composed.Documentation only. Pairs with
AlgoJudge/AlgoJudge-OpsandAlgoJudge/AlgoJudge-Docs, which say the same thing to an operator.