Merge pull request #630 from gavinuhma/auth-fix

set Access-Control-Allow-Origin header to origin to enable withCredentials
socketio · Nov 22, 2011 · 17d0f4d · 17d0f4d
2 parents 5ee6b43 + 61e7e89
commit 17d0f4d
Showing 1 changed file with 2 additions and 5 deletions.
diff --git a/lib/manager.js b/lib/manager.js
@@ -727,11 +727,8 @@ Manager.prototype.handleHandshake = function (data, req, res) {
 
   if (origin) {
     // https://developer.mozilla.org/En/HTTP_Access_Control
-    headers['Access-Control-Allow-Origin'] = '*';
-
-    if (req.headers.cookie) {
-      headers['Access-Control-Allow-Credentials'] = 'true';
-    }
+    headers['Access-Control-Allow-Origin'] = origin;
+    headers['Access-Control-Allow-Credentials'] = 'true';
   }
 
   this.authorize(handshakeData, function (err, authorized, newData) {