Merge pull request #168 from sockjs/cors-eventsource

Add CORS headers to eventsource
sockjs · Oct 22, 2014 · 259f0eb · 259f0eb
2 parents b1d86b1 + d3b6c06
commit 259f0eb
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 2 deletions.
diff --git a/src/trans-eventsource.coffee b/src/trans-eventsource.coffee
@@ -20,7 +20,18 @@ class EventSourceReceiver extends transport.ResponseReceiver
 
 exports.app =
     eventsource: (req, res) ->
-        res.setHeader('Content-Type', 'text/event-stream; charset=UTF-8')
+        if !req.headers['origin'] or req.headers['origin'] is 'null'
+            origin = '*'
+        else
+            origin = req.headers['origin']
+            res.setHeader('Access-Control-Allow-Credentials', 'true')
+        res.setHeader('Content-Type', 'text/event-stream')
+        res.setHeader('Access-Control-Allow-Origin', origin)
+        res.setHeader('Vary', 'Origin')
+        headers = req.headers['access-control-request-headers']
+        if headers
+            res.setHeader('Access-Control-Allow-Headers', headers)
+
         res.writeHead(200)
         # Opera needs one more new line at the start.
         res.write('\r\n')

diff --git a/src/trans-xhr.coffee b/src/trans-xhr.coffee
@@ -61,12 +61,12 @@ exports.app =
             origin = '*'
         else
             origin = req.headers['origin']
+            res.setHeader('Access-Control-Allow-Credentials', 'true')
         res.setHeader('Access-Control-Allow-Origin', origin)
         res.setHeader('Vary', 'Origin')
         headers = req.headers['access-control-request-headers']
         if headers
             res.setHeader('Access-Control-Allow-Headers', headers)
-        res.setHeader('Access-Control-Allow-Credentials', 'true')
         return content
 
     xhr_poll: (req, res, _, next_filter) ->