fix GH-211, set CORS headers when sending error message

Author: mokesmokes2

lib/server.js

@@ -169,7 +169,7 @@ Server.prototype.handleRequest = function(req, res){
   var self = this;
   this.verify(req, false, function(err, success) {
     if (!success) {
-      sendErrorMessage(res, err);
+      sendErrorMessage(req, res, err);
       return;
     }
 
@@ -190,8 +190,16 @@ Server.prototype.handleRequest = function(req, res){
  * @api private
  */
 
- function sendErrorMessage(res, code) {
-    res.writeHead(400, { 'Content-Type': 'application/json' });
+ function sendErrorMessage(req, res, code) {
+    var headers = { 'Content-Type': 'application/json' };
+
+    if (req.headers.origin) {
+      headers['Access-Control-Allow-Credentials'] = 'true';
+      headers['Access-Control-Allow-Origin'] = req.headers.origin;
+    } else {
+      headers['Access-Control-Allow-Origin'] = '*';
+    }
+    res.writeHead(400, headers);
     res.end(JSON.stringify({
       code: code,
       message: Server.errorMessages[code]
@@ -225,7 +233,7 @@ Server.prototype.handshake = function(transport, req){
     }
   }
   catch (e) {
-    sendErrorMessage(req.res, Server.errors.BAD_REQUEST);
+    sendErrorMessage(req, req.res, Server.errors.BAD_REQUEST);
     return;
   }
   var socket = new Socket(id, this, transport, req);

test/server.js

@@ -26,6 +26,7 @@ describe('server', function () {
             expect(res.status).to.be(400);
             expect(res.body.code).to.be(0);
             expect(res.body.message).to.be('Transport unknown');
+            expect(res.header['access-control-allow-origin']).to.be('*');
             done();
           });
       });
@@ -35,11 +36,14 @@ describe('server', function () {
       // make sure we check for actual properties - not those present on every {}
       var engine = listen(function (port) {
         request.get('http://localhost:%d/engine.io/default/'.s(port))
+          .set('Origin', 'http://engine.io')
           .query({ transport: 'constructor' })
           .end(function (res) {
             expect(res.status).to.be(400);
             expect(res.body.code).to.be(0);
             expect(res.body.message).to.be('Transport unknown');
+            expect(res.header['access-control-allow-credentials']).to.be('true');
+            expect(res.header['access-control-allow-origin']).to.be('http://engine.io');
             done();
           });
       });
@@ -48,11 +52,14 @@ describe('server', function () {
     it('should disallow non-existent sids', function (done) {
       var engine = listen(function (port) {
         request.get('http://localhost:%d/engine.io/default/'.s(port))
+          .set('Origin', 'http://engine.io')
           .query({ transport: 'polling', sid: 'test' })
           .end(function (res) {
             expect(res.status).to.be(400);
             expect(res.body.code).to.be(1);
             expect(res.body.message).to.be('Session ID unknown');
+            expect(res.header['access-control-allow-credentials']).to.be('true');
+            expect(res.header['access-control-allow-origin']).to.be('http://engine.io');
             done();
           });
       });
@@ -259,11 +266,14 @@ describe('server', function () {
     it('should disallow bad requests', function (done) {
       var engine = listen(function (port) {
         request.get('http://localhost:%d/engine.io/default/'.s(port))
+          .set('Origin', 'http://engine.io')
           .query({ transport: 'websocket' })
           .end(function (res) {
             expect(res.status).to.be(400);
             expect(res.body.code).to.be(3);
             expect(res.body.message).to.be('Bad request');
+            expect(res.header['access-control-allow-credentials']).to.be('true');
+            expect(res.header['access-control-allow-origin']).to.be('http://engine.io');
             done();
           });
       });