search

browserify / http-browserify

node's http module, but for the browser
MIT License
244 stars 110 forks source link

fix: xhr.withCredentials is initially `false` #47

Open feltnerm opened 10 years ago

feltnerm commented 10 years ago

According to the XMLHttpRequest2 spec, xhr.withCredentials should be initially false. http-browserify sets this flag to true by default which disobeys the spec. This leads to browser errors when making CORS requests to domains that have wildcards in their Access-Control-Allow-Origin header.

http-browserify should attempt to follow the spec by default. In this case, that means setting withCredentails to false initially, and then allowing the user to override that in the passing in params.

Maybe it is possible to auto-detect when user credentials are being sent and then set the withCredentials flag from there.

Somewhat related to #35 (the committer there expressed concern about withCredentials being true when unintialzed as well).

gsf commented 10 years ago

I just ran into this as well. I was glad the withCredentials option was available, but agree it should default to false.

feltnerm commented 10 years ago

I just ran into this as well. I was glad the withCredentials option was available, but agree it should default to false.

Yeah, it was annoying that I had a dependency that was using the http module but was not specifying the withCredentials option resulting in CORS errors. If withCredentials followed the spec, I would not have to modify/fork dependencies to work with http in the browser.

agrueneberg commented 10 years ago

I ran into this as well. Please merge. xhr.withCredentials definitely shouldn't be true by default.

imhoffd commented 10 years ago

This is not good. Please merge.

feltnerm commented 9 years ago

similar to #90