Patching withCredentials causes Access Denied errors in IE9 about xhook

[jpillora]

Good question, read from jpillora/xdomain#21 (comment) onwards. In short, it's for jQuery, however, due to all these conflicts maybe a smarter way to do is to add a custom ajax transport.

[jpillora]

Actually, a much easier fix if(jQuery) jQuery.support.cors = true;, trying to remember if we patch withCredentials for any other reason...

[jpillora]

Oh yes, script load sequence. If jQuery is loaded after XHook, then XHook won't have a reference to it yet. If jQuery is loaded before then possibly other libraries are also loaded before, and some libraries grab hold of window.XMLHttpRequest thereby preventing XHook from patching it. And adding an ajax transport would have the same load sequence problem. Still, there might be a nicer solution to this...

[brian-mann]

Okay I'm testing with what was suggested: turn off xhook withCredentials, and forcing jQuery support cors to be true.

All of our authenticated CORS goes over XDomain (which works wonderfully well) via jQuery, and the only times it uses the native XHR is 3rd party services without authentication.

[jpillora]

So yep, that's why I've just left this with the

//fix trackers
xhook.addWithCredentials = false;
//fix jquery cors
jQuery.support.cors = true;

work around though this does need to be added to the docs...

[brian-mann]

Yup everything works with the suggested fix.

[brian-mann]

Okay... actually forcing addWithCredentials to false will then also remove it from modern browsers. I noticed suddenly all my errors stopped reporting in non IE browsers, and to my surprise, I saw that withCredentials was returning false in all new XHR instances including Firefox + Chrome.

I think the real fix here is intelligently figure out whether we should add the withCredentials by doing a check to see if the browser supports it. As it stands right now, you have to set addWithCredentials to a boolean - but I propose this fix:

xhook.addWithCredentials = ("withCredentials" in new XMLHttpRequest());

This will dynamically set that value so modern browsers have it included, and older browsers which don't natively support that property won't.

This should wrap up everything without having to educate users of the addWithCredentials method - it should just work as expected out of the box. Though, it's still worth noting the jQuery cors support patch.

[jpillora]

I agree, it should always be added in modern browsers. The problem with doing:

xhook.addWithCredentials = ("withCredentials" in new XMLHttpRequest());

is this will cause jQuery ajax to stop working under older browsers. So maybe, setting:

xhook.addWithCredentials = false

will prevent it from being added so one might assume that if it's already there, this will have no effect, so the real fix might be:

  # initialise 'withCredentials' on facade xhr in browsers with it
  # or if explicitly told to do so
  if 'withCredentials' of xhr or xhook.addWithCredentials
    facade.withCredentials = false

Putting this in now