on-demand-entries-ping does not include cookies

[reicheltp]

• I have searched the issues of this repository and believe that this is not a duplicate.

Expected Behavior

The on-demand-entries-ping should include the current cookies in the request.

Current Behavior

The on-demand-entries-ping does not include the current cookies in the request.

Steps to Reproduce (for bugs)

If required, I can build an reproduction sample, but I think its obvious.

Context

I am running a nginx as proxy splitting the request between a website served with next, and multiple microservices. All running in docker. For development I am running the website with next in dev mode within the same docker context so that the api request are handled the same way as in prod, but on localhost. The nginx is also validating the session cookies against an authentication services and exchange them for an access_token if the request is forwarded to one of the backend services. The proxy is also blocking the access to the next app if there is no token.
Since the on-demand-entries-ping does not include the cookies, the request is blocked. As a workaround I could allow all _next/... requests with out cookies, but I think that there is no reason why the on-demand-entries-ping should not include the credentials.

Solution

Add { credentials: 'same-origin' } as parameter to the fetch requests, here: https://github.com/zeit/next.js/blob/v3-beta/client/on-demand-entries-client.js#L14 and here: https://github.com/zeit/next.js/blob/v3-beta/client/on-demand-entries-client.js#L19.

If this is an appropriate solution and you have no concerns I can send an PR, asap.

Your Environment

• Next.js version: 3.0.1-beta.8
• Environment name and version (e.g. Chrome 39, Node.js 5.4): node:8-alpine
• Operating System (Linux, maxOS, Windows): docker on Linux

[arunoda]

This is an interesting way to using the dev mode. Anyway, I don't mind including cookies for those requests. Send us a PR.

[ivan-aksamentov]

It seems that the #2509 has been overwritten during merging of universal-webpack.
@timneutkens Could we please bring { credentials: 'same-origin' } back? #3968