Make withCredentials a param allowing caller to set
#35
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
+1 I also run in trouble with the After commenting out in my |
MaxGfeller
added a commit
to MaxGfeller/youtube-search
that referenced
this pull request
Jan 29, 2014
Layed the basis for making this module browserifyable by sending all requests via corsproxy.com. Currently this is not yet possible because of this issue in http-browserify: browserify/http-browserify#35
|
merged in 1.3.1. |
ghost
closed this
feltnerm
added a commit
to feltnerm/http-browserify
that referenced
this pull request
Mar 28, 2014
According to the [XMLHttpRequest2 spec](http://www.w3.org/TR/XMLHttpRequest2/#the-withcredentials-attribute), `xhr.withCredentials` should be initially `false`. http-browserify sets this flag to `true` by default which disobeys the spec. This leads to browser errors when making CORS requests to domains that have wildcards in their Access-Control-Allow-Origin header. http-browserify should attempt to follow the spec by default. In this case, that means setting `withCredentails` to `false` initially, and then allowing the user to override that in the passing in `params`. Maybe it is possible to auto-detect when [user credentials](http://www.w3.org/TR/XMLHttpRequest2/#user-credentials) are being sent and then set the `withCredentials` flag from there. Somewhat related to browserify#35 (the committer there expressed concern about `withCredentials` being `true` when unintialzed as well).
|
Is this (forcing the user to override the defaults set via the spec) really the best solution? @substack , please look at #47. Much ❤️ for what you do @substack, thanks. |
This pull request was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Wasn't sure if there was a solid reason for forcing
withCredentialsto be true and thought it would be useful to make a param. I am working with a server that doesn't support the credentials header.