TYPO3 Core

How to reproduce:

• add basic auth protection to the TYPO3 backend or the whole site
• use at least Google Chrome 64
• try to add/edit a content element or page properties
  => you're directly prompted for credentials again

• add basic auth protection to the TYPO3 backend or the whole site
• use at least Google Chrome 64
• try to open any module that contains the page tree or try to refresh the page tree
  => you're directly prompted for credentials again

In TYPO3 8.7 this is the code snippet where d3.json is called: https://github.com/TYPO3/TYPO3.CMS/blame/TYPO3_8-7/typo3/sysext/backend/Resources/Public/JavaScript/FormEngine/Element/SvgTree.js#L168

It was introduced with this Feature: https://forge.typo3.org/issues/76108

One solution would be to migrate to v5 and change the d3.json (swicthing also request component from d3-request to d3-fetch where you can pass configuration options like

d3.json("path/to/file.json", {credentials: "include"});

Another solution would be to patch d3 manually like in my pull request:
https://github.com/d3/d3-request/pull/34/files

What needs to be done to backport this patch for TYPO3 8.7 as well? On Feb 6th, the next patch release for TYPO3 8.7 is scheduled and it would be great to have this patch in the next release!

Patch set 2 for branch TYPO3_8-7 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55559

Patch set 3 for branch TYPO3_8-7 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55559