Authentication should support CORS about pusher-js

[fiatjaf]

Today you would have to do

Pusher.Runtime.createXHR = function () {
  var xhr = new XMLHttpRequest()
  xhr.withCredentials = true
  return xhr
}

[tadas-s]

Hello,

Are there any plans to implement this? 4 years later, IE9 is largely irrelevant browser.

Cheers guys

[seven1m]

Had the same need (enable withCredentials on the xhr). This was my solution:

Pusher.XHR = ->
  xhr = new XMLHttpRequest()
  xhr.withCredentials = true
  xhr

[pl]

Hi Ryan,

You're right about pusher-js not setting the withCredentials flag, but it's not required for CORS. It only tells whether to send cookies and some headers with the request; browsers will send CORS headers regardless of its value.

https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest

However, the AJAX authorizer will not work in some environments - for example Opera < 12 or IE < 10. For cross-origin auth pusher-js implements the JSONP authorizer, which works in every browser supported by pusher-js.

http://pusher.com/docs/authenticating_users#jsonp_authentication

[ryandotsmith]

Thanks for pointing me at the right place. I have my setup working correctly now. I still think it would be nice if the library would send credentials on the xhr request.

[chris-martin]

I just spent a while tracking this down. The documentation perhaps could make it a little more clear that jsonp is the only supported way to do cross-origin auth.