Thream/socketio-jwt
Archived
2
1
Fork 0
Code Issues Pull Requests Releases Activity

Merge pull request #36 from TeamSynergy/cors_workaround

Browse Source 
Cors workaround
This commit is contained in:
José F. Romaniello 2013-11-21 03:21:46 -08:00
commit bd0980e3ab
2 changed files with 22 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
README.md
View File

@ -121,9 +121,27 @@ passportSocketIo.filterSocketsByUser(io, function(user){
});
```
## CORS-Workaround:
If you happen to have to work with Cross-Origin-Requests (marked by socket.io as `handshake.xdomain`) then here's a workaround:
### Clientside:
You have to provide the session-cookie. If you haven't set a name yet, do it like this: `app.use(express.session({ key: 'your.sid-key' }));`
```javascript
// Note: ther's no readCookie-function built in.
// Get your own in the internetz
socket = io.connect('//' + window.location.host, {
query: 'session_id=' + readCookie('your.sid-key')
});
```
### Serverside:
Nope, there's nothing to do on the server side. Just be sure that the cookies names match.
## Notes:
* Does **NOT** support cookie-based sessions. eg: `express.cookieSession`
* If the connection fails, check if you are requesting from a client via CORS. Check `socket.handshake.xdomain === true` as there are no cookies sent.
* If the connection fails, check if you are requesting from a client via CORS. Check `socket.handshake.xdomain === true` as there are no cookies sent. For a workaround look at the code above.
## Contribute
You are always welcome to open an issue or provide a pull-request!

6
lib/index.js
View File

@ -35,13 +35,13 @@ function authorize(options) {
return function(data, accept){
data.cookie = parseCookie(auth, data.headers.cookie || '');
data.sessionID = data.cookie[auth.key] || '';
data.sessionID = data.query.session_id || data.cookie[auth.key] || '';
data[auth.userProperty] = {
logged_in: false
};
if(data.xdomain)
return auth.fail(data, 'Can not read cookies from CORS-Requests.', false, accept);
if(data.xdomain && !data.sessionID)
return auth.fail(data, 'Can not read cookies from CORS-Requests. See CORS-Workaround in the readme.', false, accept);
auth.store.get(data.sessionID, function(err, session){
if(err)