Journalist API responses include Set-Cookie/Vary headers

[heartsucker]

Description

The API includes the Set-Cookie header and Vary: Cookie when they should not as they are not relevant to accessing the API.

Steps to Reproduce

In one terminal: make dev.
In another: http HEAD localhost:8081/api/v1

Expected Behavior

HTTP/1.0 200 OK
Content-Length: 198
Content-Type: application/json
Date: Mon, 15 Oct 2018 13:06:32 GMT
Server: Werkzeug/0.14.1 Python/2.7.6

Actual Behavior

HTTP/1.0 200 OK
Content-Length: 198
Content-Type: application/json
Date: Mon, 15 Oct 2018 13:06:32 GMT
Server: Werkzeug/0.14.1 Python/2.7.6
Set-Cookie: js=eyJleHBpcmVzIjp7IiBkIjoiTW9uLCAxNSBPY3QgMjAxOCAxNTowNjozMiBHTVQifX0.DqYiWA.-hH2qepnrLDYF8HV79vsn29TfhY; HttpOnly; Path=/
Vary: Cookie

Comments

I have tried implementing and override to SecureSessionInterface that doesn't set a cookie if the endpoint matches the API endpoint, but... no dice so far.

[vivekanand1101]

@heartsucker are you still working on this or i can give it a try?

[heartsucker]

I'm not actively working on it, so if you'd like to give it a try that'd be very helpful!

[vivekanand1101]

batman on it.

[vivekanand1101]

I am not able to give it as much time as i thought i would. So, if anyone wants to take this, they are free to