Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add lemmy v0.19 authentication support #750

Merged
merged 2 commits into from
Oct 5, 2023
Merged

Add lemmy v0.19 authentication support #750

merged 2 commits into from
Oct 5, 2023

Conversation

aeharding
Copy link
Owner

NOTE: This just fixes auth for lemmy v0.19.

One month after lemmy v0.19 is released, a new version of Voyager will be released that phases out support for v0.18.

This will allow Voyager to adopt new v0.19 features.

NOTE 2: A new, breaking change of Voyager (Voyager v2) will likely be released sooner than that. Since the native clients can send a custom Cookie header, we can upgrade lemmy-js-client sooner than that. The web version will remain stuck of Voyager v1 until most Lemmy servers have a chance to upgrade to v0.19 (one month after v0.19 release)

NOTE3: Phase 2 PR is coming soon.

@aeharding aeharding merged commit 9cc9a3e into main Oct 5, 2023
2 checks passed
@aeharding aeharding deleted the 0.19-pt1 branch October 5, 2023 21:41
@phiresky
Copy link

phiresky commented Oct 7, 2023

Hey. quick question about this. even with 0.19 you still get the jwt token in the login body json response.

And you don't need to set a cookie header, you can also set a Authorization: `Bearer ${jwt}` header, which should work fine with the fetch api (https://stackoverflow.com/a/48943220/2639190 ). Did you consider this when saying you need to break backwards compat?

edit: i see you're using that header. maybe you need to add withCredentials: true, credentials: 'include', as seen in the above answer? or I'm missing something.

@aeharding
Copy link
Owner Author

Lemmy 0.18 doesn’t support the authorization header afaik. Only the cookie header (or auth url parameter)

@phiresky
Copy link

phiresky commented Oct 7, 2023

yes but you can still send both right? should be independent of other new features. I mean make sense to drop support at some point just wondering about your reasoning and if there's any incompatibility on Lemmy s side

@aeharding
Copy link
Owner Author

Yes, I can send both - However, lemmy-js-client v0.19 removes support for auth URL param. Which means that the only way to authenticate with lemmy v0.18 using lemmy-js-client v0.19 is to use the cookie header (which is incompatible with web-based clients)

That's why this PR keeps lemmy-js-client v0.18 - as a stopgap to allow compatibility with lemmy v0.18 and v0.19 for web-based clients. The only downside is since lemmy-js-client is stuck on v0.18, I can't take advantage of any new v0.19 features.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants