fix: auth cookie set + graphQL http link

client/js/app.js

@@ -9,7 +9,9 @@ import VueResource from 'vue-resource'
 import VueClipboards from 'vue-clipboards'
 import VeeValidate from 'vee-validate'
 import { ApolloClient } from 'apollo-client'
-import { HttpLink } from 'apollo-link-http'
+import { ApolloLink } from 'apollo-link'
+import { createApolloFetch } from 'apollo-fetch'
+import { BatchHttpLink } from 'apollo-link-batch-http'
 import { InMemoryCache } from 'apollo-cache-inmemory'
 import store from './store'
 
@@ -71,10 +73,33 @@ window.CONSTANTS = CONSTANTS
 // Initialize Apollo Client (GraphQL)
 // ====================================
 
+const graphQLEndpoint = window.location.protocol + '//' + window.location.host + siteConfig.path + 'graphql'
+
+const apolloFetch = createApolloFetch({
+  uri: graphQLEndpoint,
+  constructOptions: (requestOrRequests, options) => ({
+    ...options,
+    method: 'POST',
+    body: JSON.stringify(requestOrRequests),
+    credentials: 'include'
+  })
+})
+
 window.graphQL = new ApolloClient({
-  link: new HttpLink({
-    uri: window.location.protocol + '//' + window.location.host + siteConfig.path + 'graphql'
-  }),
+  link: ApolloLink.from([
+    new ApolloLink((operation, forward) => {
+      operation.setContext({
+        headers: {
+          'Content-Type': 'application/json'
+        }
+      })
+
+      return forward(operation)
+    }),
+    new BatchHttpLink({
+      fetch: apolloFetch
+    })
+  ]),
   cache: new InMemoryCache(),
   connectToDevTools: (process.env.node_env === 'development')
 })

package.json

@@ -53,6 +53,7 @@
     "connect-flash": "0.1.1",
     "connect-redis": "3.3.3",
     "cookie-parser": "1.4.3",
+    "cors": "2.8.4",
     "diff2html": "2.3.3",
     "dotize": "^0.2.0",
     "execa": "0.9.0",
@@ -139,6 +140,8 @@
     "@glimpse/glimpse": "0.22.15",
     "@panter/vue-i18next": "0.9.1",
     "apollo-client-preset": "1.0.6",
+    "apollo-fetch": "0.7.0",
+    "apollo-link-batch-http": "1.0.4",
     "autoprefixer": "7.2.5",
     "babel-cli": "6.26.0",
     "babel-core": "6.26.0",

server/app/data.yml

@@ -45,6 +45,12 @@ defaults:
       path: ''
       rtl: false
       title: Wiki.js
+    # System defaults
+    cors:
+      credentials: true
+      maxAge: 600
+      methods: 'GET,POST'
+      origin: true
 configNamespaces:
   - auth
   - features

server/master.js

@@ -22,6 +22,7 @@ module.exports = async () => {
   const bodyParser = require('body-parser')
   const compression = require('compression')
   const cookieParser = require('cookie-parser')
+  const cors = require('cors')
   const express = require('express')
   const favicon = require('serve-favicon')
   const flash = require('connect-flash')
@@ -48,6 +49,9 @@ module.exports = async () => {
   // ----------------------------------------
 
   app.use(mw.security)
+  app.use(cors(wiki.config.cors))
+  app.options('*', cors(wiki.config.cors))
+  app.enable('trust proxy')
 
   // ----------------------------------------
   // Public Assets