How to disable 'withcredentials' in HTTP header with node.js and Request package?

Question

Using node.js and the Request package from the browser (via browserify), I am using CORS to do a HTTP GET request on a separate domain.

On the server, when I set 'Access-Control-Allow-Origin' to the wildcard '*', I get the following error on the client:

XMLHttpRequest cannot load .... A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin '...' is therefore not allowed access.

The HTTP request header looks like this:

Accept:*/*
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8,ja;q=0.6
Access-Control-Request-Headers:withcredentials
Access-Control-Request-Method:GET
Cache-Control:no-cache
Connection:keep-alive
Host:localhost:3000
Origin:http://localhost:9966
Pragma:no-cache
Referer:http://localhost:9966/
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

So clearly the problem is Access-Control-Request-Headers:withcredentials in the header, right?

To be able to remove this, I need to set the 'withcredentials' property of the 'XMLHttpRequest' object to 'false'. However, I cannot figure out where node.js or the Request package are creating the 'XMLHttpRequest' object, and how I can even access this.

Thanks.

It isn't in the docs, but looking at the way request uses http-browserify, I think you should be able to do req.withCredentials = false; before calling .write or .end. — loganfsmyth
– loganfsmyth, Commented Jun 26, 2014 at 15:33
@loganfsmyth Thanks for your help! It led me in the right direction. Answer posted below. — smg
– smg, Commented Jun 27, 2014 at 2:28

smg · Accepted Answer · 2014-06-27 02:39:51Z

16

After some investigation, I discovered that the withCredentials setting can be passed in via the options parameter object:

var req = http.request({
    withCredentials: false
}, function(res) {
    //...
});

req.end();

If undefined, the default setting is true.

Reference from the http-browserify/lib/request.js source:

if (typeof params.withCredentials === 'undefined') {
    params.withCredentials = true;
}

try { xhr.withCredentials = params.withCredentials }
catch (e) {}

edited Jun 27, 2014 at 2:39

answered Jun 27, 2014 at 2:27

smg

1,2231 gold badge13 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to disable 'withcredentials' in HTTP header with node.js and Request package?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related