Javascript client library for the Ermes framework

Introduction 📖

Ermes (Edge-to-Cloud Resource Management for Enhanced Session-based applications)

Usage

Installation

The module is available on npm.

npm install @ermes-labs/client

Usage

The module exports an ErmesClient class.

import { ErmesClient } from "@ermes-labs/client"

The class act as a fetch wrapper. ErmesClient.fetch has the same signature of fetch, but instead of accepting a complete URL, it requires only the resource path (and eventually query string) and manages the hostname internally.

// Initialize a client with options.
const client = new ErmesClient(options)
// Fetch some resources.
const response = client.fetch("/resource", fetchOptions)

The class constructor accept options to define how the token is extracted from the response, and the initial origin.

type ErmesClientOptions =
  | {
      // The name of the header that will contain the ermes token.
      tokenHeaderName?: string;
      // The initial origin will be set to "window.location.origin"
    }
  | {
      // The name of the header that will contain the ermes token.
      tokenHeaderName?: string;
      // The initial origin. New tokens may update the host value.
      initialOrigin: string | URL;
    }
  | {
      // The name of the header that will contain the ermes token.
      tokenHeaderName?: string;
      // The protocol to use.
      scheme?: "http" | "https";
      // Init the client with a token. Useful if a session is already present.
      initialToken: SessionToken;
    };

Response headers 📖

On the server, the following response headers must be set:

• Access-Control-Allow-Origin: This header must not be the wildcard '*' when responding to credentialed requests. Instead, it must specify the allowed origin explicitly or reflect the Origin header from the request.

• Access-Control-Allow-Credentials: This header must be set to true to tell the browser that the server allows credentials for a cross-origin request. If this header is missing, the browser will not expose the response to the frontend JavaScript code, and it will not send credentials in future requests to the server.

• Access-Control-Allow-Headers: This header is used in response to a preflight request which includes the Access-Control-Request-Headers to indicate which HTTP headers can be used during the actual request. This is relevant if you are sending headers other than simple headers (like Content-Type, Accept, etc.).

• Access-Control-Allow-Methods: In response to a preflight request, this header specifies the method or methods allowed when accessing the resource in question.