Unleash / unleash / 11344923685

87%

master: 91%

push

github

fix: same site api call with session cookie (#8435)

## About the changes
This fixes #8029. How to reproduce the issue is in the ticket.

The issue happens because when a web app is hosted in the same domain as
Unleash UI and the web app uses unleash SDK to make requests to Unleash,
the browser automatically includes the cookie in the request headers,
because:

- The request URL matches the cookie's Path attribute (which it does in
this case).
- The request is sent to the same domain (which it is, since both apps
are under the same domain).

And this is by design in the HTTP cookie specification:
https://datatracker.ietf.org/doc/html/rfc6265

This PR avoids overriding the API user with the session user if there's
already an API user in the request. It's an alternative to
https://github.com/Unleash/unleash/pull/8434

Closes #8029

2753 of 3586 branches covered (76.77%)

1 of 1 new or added line in 1 file covered. (100.0%)

13966 of 15938 relevant lines covered (87.63%)

714.8 hits per line