MCC shell: fetch against location.origin so embedded-URL credentials don't throw 'URL includes credentials'

2b26633b1c07c48ad5b6d8a73c195257c5e13657 · 2026-06-13 08:44:27 -0700 · Steve Abrams

Files touched

M public/app.js

Diff

commit 2b26633b1c07c48ad5b6d8a73c195257c5e13657
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat Jun 13 08:44:27 2026 -0700

    MCC shell: fetch against location.origin so embedded-URL credentials don't throw 'URL includes credentials'
---
 public/app.js | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/public/app.js b/public/app.js
index d1842f2..e19f805 100644
--- a/public/app.js
+++ b/public/app.js
@@ -18,8 +18,13 @@ const GROUPS = [
   { name: 'Planning', ids: ['calendar', 'vendors'] },
 ];
 
+// Always fetch against the bare origin. If the page itself was opened with
+// embedded credentials (http://user:pass@host), relative URLs resolve against
+// that credentialed base and fetch() throws "URL that includes credentials".
+// location.origin never carries credentials, so this is immune to that.
+const ORIGIN = location.origin;
 async function jget(url) {
-  const r = await fetch(url, { credentials: 'same-origin' });
+  const r = await fetch(ORIGIN + url, { credentials: 'same-origin' });
   if (!r.ok) throw new Error(`${url} → HTTP ${r.status}`);
   return r.json();
 }
@@ -94,11 +99,11 @@ async function route() {
   const panel = $('#panel');
   panel.innerHTML = '<div class="loading">Loading…</div>';
   let html = '';
-  try { const r = await fetch(`/panels/${id}.html`, { credentials: 'same-origin' }); html = r.ok ? await r.text() : ''; } catch {}
+  try { const r = await fetch(`${ORIGIN}/panels/${id}.html`, { credentials: 'same-origin' }); html = r.ok ? await r.text() : ''; } catch {}
   panel.innerHTML = html || `<div class="muted-banner">The “${meta.title}” panel isn’t built yet.</div>`;
   if (!loaded.has(id)) {
     await new Promise(res => {
-      const s = document.createElement('script'); s.src = `/panels/${id}.js`;
+      const s = document.createElement('script'); s.src = `${ORIGIN}/panels/${id}.js`;
       s.onload = res; s.onerror = res; document.body.appendChild(s);
     });
     loaded.add(id);

← c79449d MCC shell: fix auth-cookie so fetch() works (was hanging on · back to Marketing Command Center · Channels: self-serve Activate page — paste app creds in-brow bdfc352 →