Set PCC-GRANT cookie very permissively

pantheon-systems · Jul 2, 2024 · 87fdf27 · 87fdf27
1 parent 321b747
commit 87fdf27
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 2 deletions.
diff --git a/.changeset/young-maps-fly.md b/.changeset/young-maps-fly.md
@@ -0,0 +1,5 @@
+---
+"@pantheon-systems/pcc-sdk-core": patch
+---
+
+PCC-GRANT (preview token) cookie now set with most relaxed security so that preview-pages can be shown in iframes.
diff --git a/.github/workflows/changeset.yml b/.github/workflows/changeset.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout code repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: setup node.js

diff --git a/packages/core/src/core/pantheon-api.ts b/packages/core/src/core/pantheon-api.ts
@@ -127,7 +127,7 @@ export const PantheonAPI = (givenOptions?: PantheonAPIOptions) => {
 
     // Set or delete the PCC-GRANT cookie.
     if (pccGrant) {
-      await setCookie(res, `PCC-GRANT=${pccGrant}; Path=/; SameSite=Lax`);
+      await setCookie(res, `PCC-GRANT=${pccGrant}; Path=/; SameSite=None;Secure;`);
     } else if (
       options?.getSiteId != null &&
       req.cookies?.["PCC-GRANT"] != null