Action server cookie credentials#1784

Merged

dandelany merged 10 commits into

feat/action-server-cookie-credentials

Feb 25, 2026

Commits on Feb 20, 2026

Extract env-configurable cookies from /secrets calls and pass into the final action secrets.
AaronPlave
committed
Optionally enforce Access-Control-Allow-Origin on env-configurable origin. Falls back to reflecting request origin and then falls back to *.
AaronPlave
committed
Add new env vars to main docker-compose
AaronPlave
committed
Add action server test for cookie handling
AaronPlave
committed
Use action-server configuration system instead of reading directly from process.env
AaronPlave
committed
Env/configuration file updates
AaronPlave
committed
Only set `Access-Control-Allow-Credentials` to true when `ACTION_CORS_ALLOWED_ORIGIN` env is configured to prevent any origin to make credentialed requests.
AaronPlave
committed

Commits on Feb 23, 2026

Use * instead of reflecting for simplicity when no origin configured
AaronPlave
committed

Commits on Feb 24, 2026

Updates to reflect new UI env var `PUBLIC_ACTION_INCLUDE_CREDENTIALS`
AaronPlave
committed

Commits on Feb 25, 2026

update extractCookies to use cookie library parser
dandelany
committed