fix: xhr.withCredentials is initially false
#47
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
According to the [XMLHttpRequest2 spec](http://www.w3.org/TR/XMLHttpRequest2/#the-withcredentials-attribute), `xhr.withCredentials` should be initially `false`. http-browserify sets this flag to `true` by default which disobeys the spec. This leads to browser errors when making CORS requests to domains that have wildcards in their Access-Control-Allow-Origin header. http-browserify should attempt to follow the spec by default. In this case, that means setting `withCredentails` to `false` initially, and then allowing the user to override that in the passing in `params`. Maybe it is possible to auto-detect when [user credentials](http://www.w3.org/TR/XMLHttpRequest2/#user-credentials) are being sent and then set the `withCredentials` flag from there. Somewhat related to browserify#35 (the committer there expressed concern about `withCredentials` being `true` when unintialzed as well).
|
I just ran into this as well. I was glad the withCredentials option was available, but agree it should default to false. |
Yeah, it was annoying that I had a dependency that was using the |
|
I ran into this as well. Please merge. |
|
This is not good. Please merge. |
gsf
pushed a commit
to gsf/http-browserify
that referenced
this pull request
Jun 23, 2014
This was referenced Jun 26, 2014
|
similar to #90 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
According to the XMLHttpRequest2 spec,
xhr.withCredentialsshould be initiallyfalse. http-browserify sets thisflag to
trueby default which disobeys the spec. This leads to browser errors whenmaking CORS requests to domains that have wildcards in their
Access-Control-Allow-Origin header.
http-browserify should attempt to follow the spec by default. In this case,
that means setting
withCredentailstofalseinitially, and then allowingthe user to override that in the passing in
params.Maybe it is possible to auto-detect when user credentials
are being sent and then set the
withCredentialsflag from there.Somewhat related to #35 (the committer there expressed concern about
withCredentialsbeingtruewhen unintialzed as well).