IE10 considering all requests cross origin #347

Closed
dudeman opened this Issue Feb 14, 2014 · 4 comments

Comments

Projects
None yet
2 participants

dudeman commented Feb 14, 2014

On IE10 when you create a link via javascript, the host will include the port, however for links already on the page the host doesn't include the port. Which means for the cross origin check, the hosts are not matching (the existing link's host doesn't have the port in it while the one generated for the document's location does).

Here's the problem in action from an IE console session:

a = document.getElementsByTagName('a')[0] 
>> a.host 
"www.example.com" 
>> a.href 
"http://www.example.com/other.html" 
>> (b = document.createElement('a')).href = a.href 
"http://www.example.com/other.html" 
>> b.host 
"computron.local:80"

Not sure how'd you'd like to fix, but I can put together a PR if you'd like, I was thinking the safest thing to do would be to make sure they're all processed the same (existing links and ones generated for parsing).

Collaborator

reed commented Feb 14, 2014

Are you working off the latest release or master?

dudeman commented Feb 14, 2014

Sorry should have specified, that's on master.

Collaborator

reed commented Feb 14, 2014

Would this work?

# Before
@origin = [@protocol, '//', @host].join ''

# After
@origin = [@protocol, '//', @hostname].join ''
@origin += ":#{@port}" unless @port.length is 0

Browsers seem to implement host differently, but hostname shouldn't ever include the port.

dudeman commented Feb 14, 2014

Looks good to me.
Thanks!

reed closed this in 2405f8c Feb 14, 2014

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment