Skip to content

[WS-2388]: Consume x-id-oidc-signedin header in Simorgh SSR and set initialIsSignedIn#13951

Open
LukasFrm wants to merge 2 commits intolatestfrom
WS-2388-consume-x-id-oidc-signedin-header-in-simorgh-ssr-and-set-initial-initialissignedin
Open

[WS-2388]: Consume x-id-oidc-signedin header in Simorgh SSR and set initialIsSignedIn#13951
LukasFrm wants to merge 2 commits intolatestfrom
WS-2388-consume-x-id-oidc-signedin-header-in-simorgh-ssr-and-set-initial-initialissignedin

Conversation

@LukasFrm
Copy link
Copy Markdown
Contributor

@LukasFrm LukasFrm commented Apr 23, 2026

Resolves JIRA: https://bbc.atlassian.net/browse/WS-2388

Summary

Removes all server-side and shared code that checked the ckns_id or ckns_atkn cookies to determine sign-in state. Now, sign-in state is determined during SSR, solely by the x-id-oidc-signedin header sent by Belfrage.

Code changes

  • Removed all usage of ckns_id and ckns_atkn cookies for SSR sign-in state detection in:
    • src/app/contexts/AccountContext/index.tsx (no more cookie checks, only uses initialIsSignedIn from SSR)
    • src/app/models/types/account.ts (removed identity.idSignedInCookieName from IdctaConfig)
    • Updated all related tests and mocks to remove cookie logic and the identity field
  • Consolidated and cleaned up imports and mocks in src/app/lib/idcta/getIdctaConfig/index.test.ts

Testing

  1. Run all unit and integration tests: yarn test (all tests should pass)
  2. Manually verify that SSR sign-in state is determined by the x-id-oidc-signedin header, not cookies
  3. Confirm that client-side UAS features(Save Article button, Log in vs Your Account header button) matches those of signed-in/signed-out states with varying request headers present (x-id-oidc-signedin: 1/0)

Useful Links

@LukasFrm LukasFrm marked this pull request as ready for review April 24, 2026 08:20
Copy link
Copy Markdown
Member

@elvinasv elvinasv left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see that the x-id-oidc-signedin controls the initial state as expected (tested locally, using request header override), however we still have a layout shift on the homepage.

Image

I think this happens due to the default properties within AccountPromotionalBanner.
AccountPromotionalBanner

);
const isSignedIn =
isIdctaAvailable &&
Boolean(initialConfig?.initialIsSignedIn || clientSignedInState);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm wondering if we should still keep the client side fallback?
e.g. if for some reason the x-id-oidc-signedi hint header is missing, it would disable IDCTA/UAS functionality.

WDYT? cc @jinidev


const cookieHeader = ctx.req?.headers?.cookie;
const idctaResult = await getIdctaConfig(toggles, service, cookieHeader);
const signedInHeader = ctx.req?.headers?.['x-id-oidc-signedin'] as
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: Should we pass the ctx.req?.headers as requestHeaders to the getIdctaConfig? Then we could handle it properly without type casting

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants