{"action":"created","issue":{"url":"https://api.github.com/repos/Yaffle/EventSource/issues/57","labels_url":"https://api.github.com/repos/Yaffle/EventSource/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/Yaffle/EventSource/issues/57/comments","events_url":"https://api.github.com/repos/Yaffle/EventSource/issues/57/events","html_url":"https://github.com/Yaffle/EventSource/issues/57","id":76731665,"number":57,"title":"XDR is used on same domain request (IE9)","user":{"login":"FritsvanCampen","id":4331206,"avatar_url":"https://avatars.githubusercontent.com/u/4331206?v=3","gravatar_id":"","url":"https://api.github.com/users/FritsvanCampen","html_url":"https://github.com/FritsvanCampen","followers_url":"https://api.github.com/users/FritsvanCampen/followers","following_url":"https://api.github.com/users/FritsvanCampen/following{/other_user}","gists_url":"https://api.github.com/users/FritsvanCampen/gists{/gist_id}","starred_url":"https://api.github.com/users/FritsvanCampen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FritsvanCampen/subscriptions","organizations_url":"https://api.github.com/users/FritsvanCampen/orgs","repos_url":"https://api.github.com/users/FritsvanCampen/repos","events_url":"https://api.github.com/users/FritsvanCampen/events{/privacy}","received_events_url":"https://api.github.com/users/FritsvanCampen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-15T13:47:02Z","updated_at":"2015-05-15T18:32:56Z","closed_at":null,"body":"EventSource has a long-polling fallback for browsers that don't support event streams.\r\nEventSource also supports cross-domain-requests.\r\nIn IE9 you need to make an XDomainRequest (instead of XMLHttpRequest) if you want to do a cross-domain-request.\r\n\r\nThe problem is that code doesn't check properly whether the request _is_ a cross-domain-request when deciding between XDR or XHR, it just always uses XDR (in IE9). This is important because an XDR requires a CORS policy (Allow-Access-* headers). It's silly to _require_ a CORS policy for same-domain-requests. Not settings the CORS policy headers will cause IE9 to discard the response.\r\n\r\nDe decision is:\r\n\r\n    Transport = isCORSSupported ? XHR : (XDR !== undefined ? XDR : undefined)\r\n\r\nAs you can see it just checks whether CORS is supported, not wether CORS is required. Later on when `Transport` is about to be used there is:\r\n\r\n    var withCredentials = isCORSSupported && options !== undefined && Boolean(options.withCredentials);\r\n\r\nWe can use `withCredentials` to decide between XDR or XHR:\r\n\r\n    var xhr = new Transport(); // always yields XDR (in IE9)\r\n    // change to:\r\n    var xhr = withCredentials ? new Transport() : new XHR();\r\n\r\nThis fixes the problem but I feel like a refactor is required.\r\n\r\nWhat if a cross-domain-request is required but is not supported?\r\n\r\n---\r\n\r\nThis is related to: https://github.com/Yaffle/EventSource/issues/41 but the suggestion to force XHR is silly, it should use whatever is required (but prefer XHR). I think my fix also solves that issue."},"comment":{"url":"https://api.github.com/repos/Yaffle/EventSource/issues/comments/102486380","html_url":"https://github.com/Yaffle/EventSource/issues/57#issuecomment-102486380","issue_url":"https://api.github.com/repos/Yaffle/EventSource/issues/57","id":102486380,"user":{"login":"Yaffle","id":130792,"avatar_url":"https://avatars.githubusercontent.com/u/130792?v=3","gravatar_id":"","url":"https://api.github.com/users/Yaffle","html_url":"https://github.com/Yaffle","followers_url":"https://api.github.com/users/Yaffle/followers","following_url":"https://api.github.com/users/Yaffle/following{/other_user}","gists_url":"https://api.github.com/users/Yaffle/gists{/gist_id}","starred_url":"https://api.github.com/users/Yaffle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Yaffle/subscriptions","organizations_url":"https://api.github.com/users/Yaffle/orgs","repos_url":"https://api.github.com/users/Yaffle/repos","events_url":"https://api.github.com/users/Yaffle/events{/privacy}","received_events_url":"https://api.github.com/users/Yaffle/received_events","type":"User","site_admin":false},"created_at":"2015-05-15T18:32:56Z","updated_at":"2015-05-15T18:32:56Z","body":"> XDR should never be used on same domain requests. There doesn't need to be an option for this.\r\n\r\nWhy? XDR can be better (allows streaming)\r\n\r\nI have updated this repo.\r\nuse `new EventSource(url, {Transport: XMLHttpRequest})`\r\n"}}