From b7a28573f750191c77441cfada317a813e4c591a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Mon, 27 Apr 2026 10:17:30 +0400 Subject: [PATCH] Send SDK version as X-SDK-Version header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move the cookie-banner SDK version from the POST consents request body to a custom X-SDK-Version header sent on every API call. The server now reads it from the header and the CORS middleware allows it through preflight. Signed-off-by: Émile Ré --- packages/cookie-banner/src/client.ts | 1 - packages/cookie-banner/src/http.ts | 1 + pkg/server/api/cookiebanner/v1/cors_middleware.go | 2 +- pkg/server/api/cookiebanner/v1/handler.go | 4 ++-- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/cookie-banner/src/client.ts b/packages/cookie-banner/src/client.ts index 1587f67b9..25cbb93d9 100644 --- a/packages/cookie-banner/src/client.ts +++ b/packages/cookie-banner/src/client.ts @@ -288,7 +288,6 @@ export class CookieBannerClient { version: cfg.version, action, consent_data: consentData, - sdk_version: __SDK_VERSION__, }; void fetchJSON(url, { method: "POST", body }) .then(() => void flush(this.bannerId)) diff --git a/packages/cookie-banner/src/http.ts b/packages/cookie-banner/src/http.ts index 8017e5041..8cf8c74ed 100644 --- a/packages/cookie-banner/src/http.ts +++ b/packages/cookie-banner/src/http.ts @@ -120,6 +120,7 @@ export async function fetchJSON( credentials: "omit", headers: { Accept: "application/json", + "X-SDK-Version": __SDK_VERSION__, ...(body !== undefined && { "Content-Type": "application/json" }), ...headers, }, diff --git a/pkg/server/api/cookiebanner/v1/cors_middleware.go b/pkg/server/api/cookiebanner/v1/cors_middleware.go index a147e8bb3..9aa070427 100644 --- a/pkg/server/api/cookiebanner/v1/cors_middleware.go +++ b/pkg/server/api/cookiebanner/v1/cors_middleware.go @@ -66,7 +66,7 @@ func newCORSMiddleware(logger *log.Logger, cookieBannerSvc *cookiebanner.Service w.Header().Set("Access-Control-Allow-Origin", origin) w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS") - w.Header().Set("Access-Control-Allow-Headers", "Content-Type") + w.Header().Set("Access-Control-Allow-Headers", "Content-Type, X-SDK-Version") w.Header().Set("Access-Control-Max-Age", "600") w.Header().Set("Vary", "Origin") diff --git a/pkg/server/api/cookiebanner/v1/handler.go b/pkg/server/api/cookiebanner/v1/handler.go index afc68f6f9..5ae9bfad6 100644 --- a/pkg/server/api/cookiebanner/v1/handler.go +++ b/pkg/server/api/cookiebanner/v1/handler.go @@ -122,7 +122,6 @@ type ( Version int `json:"version"` Action coredata.CookieConsentAction `json:"action"` ConsentData json.RawMessage `json:"consent_data"` - SdkVersion string `json:"sdk_version"` } postConsentResponse struct { @@ -148,6 +147,7 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) { ip := clientip.Extract(r) ua := r.UserAgent() + sdkVersion := r.Header.Get("X-SDK-Version") req := cookiebanner.RecordConsentRequest{ Version: body.Version, @@ -156,7 +156,7 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) { UserAgent: &ua, ConsentData: body.ConsentData, Action: body.Action, - SdkVersion: body.SdkVersion, + SdkVersion: sdkVersion, } record, err := h.cookieBannerSvc.RecordConsent(r.Context(), bannerID, req)