Remove session from companion

[mifi]

Initial checklist

• I understand this is a bug report and questions should be posted in the Community Forum
• I searched issues and couldn’t find anything (or linked relevant results below)

Link to runnable example

No response

Steps to reproduce

• Go to for example https://transloadit.com/demos/handling-uploads/multiple-encoding-steps-for-the-same-file/
• open devtools
• go to for example google drive and browse thru files
• in devtools,observe that the /list calls do not contain any cookie. also observe that the responses have set-cookie with a different session cookie for each request

Expected behavior

companion should not work because cookies and sessions are not in use

Actual behavior

everything actually works.

this means we can probably remove all session code in companion, as it will simplify companion code and we don't have to worry about things like CORS cookies, secure, same-site etc.

[arturi]

@ifedapoolarewaju could I ask your opinion here, please?

[ifedapoolarewaju]

IIRC, cookies were primarily used for displaying/loading authenticated images on Uppy Client. So the use of Cookies are implicit, and maybe better tested if you check that (Google Drive, Dropbox, Instagram, One Drive, etc.) images load correctly despite disabling cookies.

I can't remember specifically which of the Providers needed it, but my first guess is Dropbox.

PS: So as not to cause a delay, I responded right away based off my fragile vague memory, and haven't done any in-depth look. If this doesn't suffice, I can take a closer look to properly jug my memory.

[arturi]

@ifedapoolarewaju thanks for the swift response! 🖤

[mifi]

I believe the set-cookie logic for thumbnails is here:

uppy/packages/@uppy/companion/src/server/controllers/send-token.js

Line 36 in 57a71e1

// some providers need the token in cookies for thumbnail/image requests

it's actually a separate cookie, e.g. uppyAuthToken--dropbox, so it doesn't use sessions at all. That's why thumbnails still work even though sessions don't work