Can the cookie be shared with another subdomain when trying to fetch document?

Docs
1

I am trying to integrate our self-hosted xwiki and self-hosted onlyoffice

xwiki: xwiki.itps.xxx.com
onlyoffice: oo.itps.xxx.com

I am storing files as attachments of xwiki pages, the problem is, some xwiki page may be protected, which means need a valid login. when OnlyOffice’s trying to fetch attachment of such pages, it will fail with 401.

can onlyoffice share xwiki’s cookie, so it can get attachments ?

when the onlyoffice javascript sending the document.url to it’s backend, I don’t know how onlyoffice server sending http request to get files, can the cookie also be copied ?

config = {
	document: {
		fileType: attachmentFileExt,
		key: attachmentHash,
		title: DOCUMENT_NAME,
		// for onlyoffice to get document as attachment please note this is server to server communication 
		// TODO if a page need login to view, will fetch attachment fail ?
		url: encodeURI(`http://${XWIKIHOST}/rest/wikis/${PAGE_URL}/attachments/${attachmentFullName}`) 
	},
	editorConfig: {
		customization: {
			autosave: false,
			chat: false,
			comments: false,
			forcesave: true
		},
		lang: 'zh',
		mode: 'view',
		location: 'cn',
		region: 'zh-CN',
		user: {
			id: shortHash(userid),
			name: xm.userReference.name
		}
	},
	height: '800px',
	documentType: documentType,
	token: 'OeIuYbNg7jVNvJD6qt9yKlpSa2qPHAvZ' // currently disabled at OnlyOffice side
}
new DocsAPI.DocEditor('onlyoffice-container', config)
2

Hello @Fanguogang

// TODO if a page need login to view, will fetch attachment fail ?

That’s correct. As the independent integrator, you must make your files available for download. Document server can’t work with authentication systems.
The only supported authentication is JWT: