mapbox / corslite

an ajax library for everyone and domains

corslite

corslite('http://b.tiles.mapbox.com/v3/tmcw.dem.json', function(err, resp) {
    // resp is the XMLHttpRequest object
}, true); // cross origin?

an AJAX library focused on simplicity and supporting IE8-10 with cross domain requests.

We're making a deal with the devil and using XDomainRequest in hopes that it is less a hack than JSONP. This comes with caveats:

• No headers are permitted on requests
• Only 'GET'
• No access error diagnostics (status code, response body) on IE

corslite's Issues

IE9

Right now IE9 works in the field (browserstack) and fails in testing (ci.testling), with an 'Access is Denied' error.

Broken in Firefox

Looks like we are not correctly catching DNS lookup errors.

success callback is called on 404 response

consistently use null or undefined for the unused callback param

Sometimes null is passed, sometimes undefined. Does node have a standard?

Uncaught TypeError: window.XDomainRequest is not a function

I'm trying to use Mapbox with Ember.js, but I'm getting an error related to window.XDomainRequest on both Chrome and Firefox. Issue happens at https://github.com/mapbox/corslite/blob/master/corslite.js#L22

It looks like that bit should only be executed on IE, since XDomainRequest only exists in IE. However, it checks this with !('withCredentials' in x), which returns true on Chrome and Firefox (which I assume it shouldn't)

I'd love to help fix this bug, but I'm afraid that I don't know enough about how CORS works.

You win at project naming.

How do we get mapbox to send along session cookies with the Cross-Origin request?

I'm trying to make a request to a resource server passing an access token that has my credentials in a shared cookie. If we can't pass the cookie we'll get a 401. Normally, with jQuery, we use { xhrFields: { withCredentials: true } }

No status with XDomainRequest

It looks like we cannot get HTTP response codes from XDomainRequest

http://msdn.microsoft.com/en-us/library/ie/cc288060(v=vs.85).aspx

consistent error object

Currently, the error object is different depending on the failure mode:

• Non-20x responses pass the XHR object as the error
• onerror responses (e.g. DNS failure) pass an event object

Checking for IE8/9 not robust enough

Corslite checks whether we are on IE by looking for withCredentials on the XMLHttpRequest object. Some mocking libraries (notably Pretender) breaks since it doesn't always have the withCredentials property on the XMLHttpRequest object.

test onabort/ontimeout cases

Currently these will throw an error if they're ever triggered (undefined evt variable).