{"action":"created","issue":{"url":"https://api.github.com/repos/sockjs/sockjs-client/issues/416","repository_url":"https://api.github.com/repos/sockjs/sockjs-client","labels_url":"https://api.github.com/repos/sockjs/sockjs-client/issues/416/labels{/name}","comments_url":"https://api.github.com/repos/sockjs/sockjs-client/issues/416/comments","events_url":"https://api.github.com/repos/sockjs/sockjs-client/issues/416/events","html_url":"https://github.com/sockjs/sockjs-client/issues/416","id":282162291,"node_id":"MDU6SXNzdWUyODIxNjIyOTE=","number":416,"title":"SockJS connection rejected because of CORS rules","user":{"login":"ycordier-pro","id":34548668,"node_id":"MDQ6VXNlcjM0NTQ4NjY4","avatar_url":"https://avatars1.githubusercontent.com/u/34548668?v=4","gravatar_id":"","url":"https://api.github.com/users/ycordier-pro","html_url":"https://github.com/ycordier-pro","followers_url":"https://api.github.com/users/ycordier-pro/followers","following_url":"https://api.github.com/users/ycordier-pro/following{/other_user}","gists_url":"https://api.github.com/users/ycordier-pro/gists{/gist_id}","starred_url":"https://api.github.com/users/ycordier-pro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ycordier-pro/subscriptions","organizations_url":"https://api.github.com/users/ycordier-pro/orgs","repos_url":"https://api.github.com/users/ycordier-pro/repos","events_url":"https://api.github.com/users/ycordier-pro/events{/privacy}","received_events_url":"https://api.github.com/users/ycordier-pro/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-12-14T16:34:51Z","updated_at":"2018-09-21T21:37:09Z","closed_at":null,"author_association":"NONE","body":"In XHR default client, the \"withCredentials\" is set to true by default: \r\nhttps://github.com/sockjs/sockjs-client/blob/a1028ed46db22e0f98d5529c0828529a8521ca6f/lib/transport/browser/abstract-xhr.js#L75\r\n\r\nThe comment above says:\r\n```\r\n// Mozilla docs says https://developer.mozilla.org/en/XMLHttpRequest :\r\n// \"This never affects same-site requests.\"\r\n\r\n```\r\nbut in fact, the Mozilla doc doesn't say this anymore...\r\n\r\nAnd this seems to be causing some issues when running SockJS client from a static HTML page served from the local file system (URL with file://) or when used within a mobile webview object , because the \"Origin\" header set by the majority of browsers is \"null\" (tested on Safari, Chrome and Firefox).\r\n\r\nThis leads to the following error when SockJS tries to connect thru websocket transport and first wants to get the \"info\" for the websocket connection :\r\n\r\n```\r\nFailed to load [xxxx__removed__xxxx]/eventbus/info?t=1513268107382: \r\nThe value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'null' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.\r\n```\r\n\r\nOn server side we must keep '*' as the Access-Control-Allow-Origin because the connection must be kept opened to any incoming domain.\r\n\r\nCommenting out line 75 of abstract-xhr transport resolves the issue, and SockJS still works fine in a \"normal\" context (when the page using SockJS is served on a standard web server thru http or https).\r\n\r\nI'm wondering whether this can be completely removed, or whether something can be done to set the XHR withCredentials parameter from SockJS options or any transport options ?\r\n\r\nThanks for your feedback!\r\n"},"comment":{"url":"https://api.github.com/repos/sockjs/sockjs-client/issues/comments/423677536","html_url":"https://github.com/sockjs/sockjs-client/issues/416#issuecomment-423677536","issue_url":"https://api.github.com/repos/sockjs/sockjs-client/issues/416","id":423677536,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMzY3NzUzNg==","user":{"login":"brycekahle","id":1010430,"node_id":"MDQ6VXNlcjEwMTA0MzA=","avatar_url":"https://avatars1.githubusercontent.com/u/1010430?v=4","gravatar_id":"","url":"https://api.github.com/users/brycekahle","html_url":"https://github.com/brycekahle","followers_url":"https://api.github.com/users/brycekahle/followers","following_url":"https://api.github.com/users/brycekahle/following{/other_user}","gists_url":"https://api.github.com/users/brycekahle/gists{/gist_id}","starred_url":"https://api.github.com/users/brycekahle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brycekahle/subscriptions","organizations_url":"https://api.github.com/users/brycekahle/orgs","repos_url":"https://api.github.com/users/brycekahle/repos","events_url":"https://api.github.com/users/brycekahle/events{/privacy}","received_events_url":"https://api.github.com/users/brycekahle/received_events","type":"User","site_admin":false},"created_at":"2018-09-21T21:37:09Z","updated_at":"2018-09-21T21:37:09Z","author_association":"CONTRIBUTOR","body":"What server (and version) are you running?"}}
{"actor":{"display_login":"brycekahle"}}