Send credentials (certificate) when retrieving token

[808x88]

When conducting the post request to get the token from the idp, we should be able to choose whether we want to send the credentials in the post request so the idp can verify who is calling to get the token with our certificate.

[brockallen]

What certificate?

[achebrol]

i would like to include the cookies while sending the token request. is it possible to set xhr.withCredentials = true; in JsonService.js

[seeshaarp]

This is really required. I am sending the token as a cookie from an api to avoid access token stroring either in session or local storage in the client side. if we dont make withcredentials = true, it ignores the repsonse cookies and cookies are not attached to the subsequent requests..

[npflood]

@brockallen There is an open pull request that fixes this issue. Please let me know if there are any changes needed.

[kimlukas]

And if you do something like this. To have your own XMLHttpRequest Factory?

Global.setXMLHttpRequest(function () {
  var request = new XMLHttpRequest();
  request.withCredentials = true;
  return request;
});