Files
slp-modular-cms/frontend/vite.config.ts
T
SluijsensandClaude Haiku 4.5 546b773781 fix(auth): add Vite dev proxy to fix SameSite=Strict cookie on page reload
Chrome 89+ treats http://localhost and https://localhost as different sites
(schemeful same-site). The refreshToken cookie (SameSite=Strict) was not
sent when the Vite dev server (HTTP) made cross-origin fetch calls to the
.NET backend (HTTPS), causing a 401 on every page reload.

Fix: route /api/* through the Vite dev server proxy so all requests stay
same-origin. The cookie is now always sent and auth sessions survive reloads.

- vite.config.ts: proxy /api → https://localhost:7221 (secure:false for dev cert)
- .env.example: document proxy vs direct mode, set default VITE_API_BASE_URL to empty
- config.ts: accept empty string as valid apiBaseUrl alongside full URLs

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-06-22 15:23:19 +02:00

48 lines
1.4 KiB
TypeScript

/// <reference types="vitest/config" />
import path from 'node:path';
import { defineConfig } from 'vite';
import react from '@vitejs/plugin-react';
import tailwindcss from '@tailwindcss/vite';
// https://vite.dev/config/
export default defineConfig({
plugins: [react(), tailwindcss()],
resolve: {
alias: {
'@': path.resolve(__dirname, './src'),
},
},
server: {
port: 5173,
proxy: {
// Route all /api calls through the Vite dev server so the browser
// sees a single origin. Without this the refreshToken cookie
// (SameSite=Strict) is not sent from http://localhost to
// https://localhost (different scheme = cross-site in Chrome 89+).
'/api': {
target: 'https://localhost:7221',
changeOrigin: true,
secure: false, // allow self-signed dev cert
},
},
},
test: {
globals: true,
environment: 'jsdom',
setupFiles: ['./src/test/setup.ts'],
css: true,
coverage: {
provider: 'v8',
reporter: ['text', 'html'],
include: ['src/**/*.{ts,tsx}'],
exclude: [
'src/**/*.test.{ts,tsx}',
'src/test/**',
'src/mocks/**',
'src/main.tsx',
'src/vite-env.d.ts',
],
},
},
});