Preflight handshake broken for credentialed CORS

[thorlarholm]

Client handshakes under Cross-origin Request Sharing are not working properly if the following conditions are met

1. Origin site and Tornadio service are running on different ports
2. The origin site has a cookie set

Only condition 1 is guaranteed to be met for the crosssite example.

When both of these conditions are present, a CORS-compliant browser will attempt to use the withCredentials property of the XMLHttpRequest object. However, this requires that the following response header are set.

• Access-Control-Allow-Origin: exactOrigin
• Access-Control-Allow-Credentials: true

where exactOrigin is self.request.headers['origin'].

Expected results:

• Access-Control-Allow-Origin: exactOrigin
• Access-Control-Allow-Credentials: true

Actual results:

• Access-Control-Allow-Origin: exactOrigin
• Access-Control-Allow-Credentials: True

Browsers are strictly enforcing a case-sensitive header value, making True invalid and true valid.

This results in a broken handshake process for any socket.io-client later than 0.8.6.

Related documentation:
http://www.w3.org/TR/cors/#access-control-allow-credentials-respons
https://developer.mozilla.org/En/HTTP_Access_Control#Requests_with_credentials

Related issue in socket.io-client:
socketio/socket.io-client#333

[thorlarholm]

Sorry, attached the commit to a separate "issue"

[mrjoes]

Thanks for the fix :-)

[thorlarholm]

Related issue:

#31