browserify / http-browserify

node's http module, but for the browser
MIT License
244 stars 110 forks source link

FIX: port derivation with 'hostname' instead of 'host' given #88

Open freitag-solutions opened 9 years ago

freitag-solutions commented 9 years ago

Problem:

When using 'hostname' instead of 'host' (as recommended by https://nodejs.org/api/http.html#http_http_request_options_callback) and omitting the 'port' option the request's port will get set to 'window.location.port' (independently of protocol and anything). This is not the case when using 'host' instead of 'hostname'.

Example (actual status):

window.location.port = 8080;
http.get({hostname: 'external-host', protocol: 'https'}); 
    // resolves to: 'https://external-host:8080/'

Example (target status):

window.location.port = 8080;
http.get({hostname: 'external-host', protocol: 'https'}); 
    // resolves to: 'https://external-host:443/'

Solution:

Derive 'host' from 'hostname' before the port is resolved.

Possible impact:

The original behavior MAY be correct for requests which target the same host and protocol as the current application. E.g. when running an application from 'http://localhost:8080' requests to {hostname: 'localhost', protocol: 'http:', port: null} COULD be resolved just as requests to {protocol: 'http', port: null} to target 'http://localhost:8080' (this pull requests resolves the former request to 'http://localhost:80').

Since I wasn't able to find any documentation about the intended behavior this is open to discussion. In my personal opinion omitting the 'port' option should always result in using default ports. Only in the special case when omitting both, hostname and port, the application may assume the request targets the host and port the current application was served from.

Unfortunately this behavior cannot be derived from node-http since the problem only occurs in browsers.