MrJoes/tornadio2 — Issue #30: Preflight handshake broken for credentialed CORS
Author: thorlarholm
Created: 2012-03-05 21:38:09+00:00
State: open

Client handshakes under Cross-origin Request Sharing are not working properly if the following conditions are met

1. Origin site and Tornadio service are running on different ports
2. The origin site has a cookie set

Only condition 1 is guaranteed to be met for the crosssite example.

When both of these conditions are present, a CORS-compliant browser will attempt to use the withCredentials property of the XMLHttpRequest object. However, this requires that the following response header are set.

* Access-Control-Allow-Origin: exactOrigin
* Access-Control-Allow-Credentials: true

where exactOrigin is self.request.headers['origin'].

Expected results:

* Access-Control-Allow-Origin: exactOrigin
* Access-Control-Allow-Credentials: true

Actual results:

* Access-Control-Allow-Origin: exactOrigin
* Access-Control-Allow-Credentials: True

Browsers are strictly enforcing a case-sensitive header value, making True invalid and true valid.

This results in a broken handshake process for any socket.io-client later than 0.8.6.

Related documentation:
http://www.w3.org/TR/cors/#access-control-allow-credentials-respons
https://developer.mozilla.org/En/HTTP_Access_Control#Requests_with_credentials

Related issue in socket.io-client:
https://github.com/LearnBoost/socket.io-client/issues/333