Make sure that XHR uses the XDomainRequest on old browsers.

build/grunt.js

@@ -286,6 +286,9 @@ module.exports = function(grunt) {
             debug: true,
             standalone: false
           },
+          plugin: [
+            ['proxyquireify/plugin']
+          ],
           banner: false,
           watch: true,
           keepAlive: true

package.json

@@ -80,6 +80,7 @@
     "karma-safari-launcher": "^0.1.1",
     "karma-sinon": "^1.0.3",
     "load-grunt-tasks": "^3.1.0",
+    "proxyquireify": "^3.0.0",
     "qunitjs": "^1.18.0",
     "sinon": "^1.16.1",
     "time-grunt": "^1.1.1",

src/js/tracks/text-track.js

@@ -10,6 +10,7 @@ import log from '../utils/log.js';
 import EventTarget from '../event-target';
 import document from 'global/document';
 import window from 'global/window';
+import { isCrossOrigin } from '../utils/url.js';
 import XHR from 'xhr';
 
 /*
@@ -253,7 +254,16 @@ var parseCues = function(srcContent, track) {
 };
 
 var loadTrack = function(src, track) {
-  XHR({ uri: src }, Fn.bind(this, function(err, response, responseBody){
+  let opts = {
+    uri: src
+  };
+
+  let crossOrigin = isCrossOrigin(src);
+  if (crossOrigin) {
+    opts.cors = crossOrigin;
+  }
+
+  XHR(opts, Fn.bind(this, function(err, response, responseBody){
     if (err) {
       return log.error(err, response);
     }

src/js/utils/url.js

@@ -2,6 +2,7 @@
  * @file url.js
  */
 import document from 'global/document';
+import window from 'global/window';
 
 /**
  * Resolve and parse the elements of a URL
@@ -95,3 +96,24 @@ export const getFileExtension = function(path) {
 
   return '';
 };
+
+/**
+ * Returns whether the url passed is a cross domain request or not.
+ *
+ * @param {String} url The url to check
+ * @return {Boolean}   Whether it is a cross domain request or not
+ * @method isCrossOrigin
+ */
+export const isCrossOrigin = function(url) {
+  let urlInfo = parseUrl(url);
+  let winLoc = window.location;
+
+  // IE8 protocol relative urls will return ':' for protocol
+  let srcProtocol = urlInfo.protocol === ':' ? winLoc.protocol : urlInfo.protocol;
+
+  // Check if url is for another domain/origin
+  // IE8 doesn't know location.origin, so we won't rely on it here
+  let crossOrigin = (srcProtocol + urlInfo.host) !== (winLoc.protocol + winLoc.host);
+
+  return crossOrigin;
+};

src/js/video.js

@@ -406,6 +406,15 @@ videojs.formatTime = formatTime;
  */
 videojs.parseUrl = Url.parseUrl;
 
+/**
+ * Returns whether the url passed is a cross domain request or not.
+ *
+ * @param {String} url The url to check
+ * @return {Boolean}   Whether it is a cross domain request or not
+ * @method isCrossOrigin
+ */
+videojs.isCrossOrigin = Url.isCrossOrigin;
+
 /**
  * Event target class.
  *

test/unit/utils/url.test.js

@@ -1,6 +1,8 @@
 import document from 'global/document';
 import window from 'global/window';
 import * as Url from '../../../src/js/utils/url.js';
+import proxyquireify from 'proxyquireify';
+const proxyquire = proxyquireify(require);
 
 q.module('url');
 
@@ -67,3 +69,32 @@ test('should get the file extension of the passed path', function() {
   equal(Url.getFileExtension('test.video.MP4'), 'mp4');
   equal(Url.getFileExtension('test.video.FLV'), 'flv');
 });
+
+// isCrossOrigin tests
+test('isCrossOrigin can identify cross origin urls', function() {
+  let win = {
+    location: {}
+  };
+  let Url = proxyquire('../../../src/js/utils/url.js', {
+    'global/window': win
+  });
+
+  win.location.protocol = window.location.protocol;
+  win.location.host = window.location.host;
+  ok(!Url.isCrossOrigin(`http://${win.location.host}/example.vtt`), 'http://google.com from http://google.com is not cross origin');
+  ok(Url.isCrossOrigin(`https://${win.location.host}/example.vtt`), 'https://google.com from http://google.com is cross origin');
+  ok(!Url.isCrossOrigin(`//${win.location.host}/example.vtt`), '//google.com from http://google.com is not cross origin');
+  ok(Url.isCrossOrigin('http://example.com/example.vtt'), 'http://example.com from http://google.com is cross origin');
+  ok(Url.isCrossOrigin('https://example.com/example.vtt'), 'https://example.com from http://google.com is cross origin');
+  ok(Url.isCrossOrigin('//example.com/example.vtt'), '//example.com from http://google.com is cross origin');
+  // we cannot test that relative urls work on https, though
+  ok(!Url.isCrossOrigin('example.vtt'), 'relative url is not cross origin');
+
+  win.location.protocol = 'https:';
+  win.location.host = 'google.com';
+  ok(Url.isCrossOrigin('http://google.com/example.vtt'), 'http://google.com from https://google.com is cross origin');
+  ok(Url.isCrossOrigin('//google.com/example.vtt'), '//google.com from https://google.com is cross origin');
+  ok(Url.isCrossOrigin('http://example.com/example.vtt'), 'http://example.com from https://google.com is cross origin');
+  ok(Url.isCrossOrigin('https://example.com/example.vtt'), 'https://example.com from https://google.com is cross origin');
+  ok(Url.isCrossOrigin('//example.com/example.vtt'), '//example.com from https://google.com is cross origin');
+});