[fix] Only allow CORS when we have a document.domain to prevent Origi…

…n:null. Fixes #281
primus · Aug 14, 2014 · 53f8856 · 53f8856
1 parent 24335cf
commit 53f8856
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 6 deletions.
diff --git a/transformers/sockjs/library.js b/transformers/sockjs/library.js
@@ -922,12 +922,14 @@ XDRObject.prototype.close = function() {
 // 3. Nope, but postMessage is there so it should work via the Iframe.
 // 4. Nope, sorry.
 utils.isXHRCorsCapable = function() {
-    if (_window.XMLHttpRequest && 'withCredentials' in new XMLHttpRequest()) {
-        return 1;
-    }
-    // XDomainRequest doesn't work if page is served from file://
-    if (_window.XDomainRequest && _document.domain) {
-        return 2;
+    // CORS doesn't work if page is served from file://
+    if (_document.domain) {
+      if (_window.XMLHttpRequest && 'withCredentials' in new XMLHttpRequest()) {
+          return 1;
+      }
+      if (_window.XDomainRequest) {
+          return 2;
+      }
     }
     if (IframeTransport.enabled()) {
         return 3;

diff --git a/transformers/sockjs/patches/cors.patch b/transformers/sockjs/patches/cors.patch
@@ -0,0 +1,25 @@
+diff --git a/transformers/sockjs/library.js b/transformers/sockjs/library.js
+index 7666a55..095fa29 100644
+--- a/transformers/sockjs/library.js
++++ b/transformers/sockjs/library.js
+@@ -922,12 +922,14 @@ XDRObject.prototype.close = function() {
+ // 3. Nope, but postMessage is there so it should work via the Iframe.
+ // 4. Nope, sorry.
+ utils.isXHRCorsCapable = function() {
+-    if (_window.XMLHttpRequest && 'withCredentials' in new XMLHttpRequest()) {
+-        return 1;
+-    }
+-    // XDomainRequest doesn't work if page is served from file://
+-    if (_window.XDomainRequest && _document.domain) {
+-        return 2;
++    // CORS doesn't work if page is served from file://
++    if (_document.domain) {
++      if (_window.XMLHttpRequest && 'withCredentials' in new XMLHttpRequest()) {
++          return 1;
++      }
++      if (_window.XDomainRequest) {
++          return 2;
++      }
+     }
+     if (IframeTransport.enabled()) {
+         return 3;