CORS problem (No 'Access-Control-Allow-Origin') on client

Hi all,

Typically if you do have server with sockets on another domain and you do simple first line io('YOUR_HOST'), you will receive this message: XMLHttpRequest cannot load YOUR_HOSTsocket.io/?EIO=3&transport=polling&t=1446467052356-0. No 'Access-Control-Allow-Origin'...

First appeared in head, that I need to look at documentation and find out how to set it from there, but eventually I did not find anything because of pure documentation. Then I entered source code and the only 2 usages of setRequestHeader method, which is actually allow you to do that, is only for setting content-type if POST method is chosen.

Could you help me to fix this issue?

[hasanraza-axovel]

I’m using cors extension for google chrome and socket.io for chat application on my nodejs+Angular2 app but it is giving follwing error. XMLHttpRequest cannot load http://localhost:8000/socket.io/?username=amit&EIO=3&transport=polling&t=LsdeeNk. The value of the ‘Access-Control-Allow-Origin’ header in the response must not be the wildcard ‘*’ when the request’s credentials mode is ‘include’. Origin ‘http://localhost:4200’ is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

[turnerhayes]

It appears that Socket.io’s definition of “origin” is somewhat different from the normal one (at least the one on MDN): Socket.io doesn’t seem to want the scheme to be included. See this block of code which checks the origin against the origins array. It looks for domain + ':' + port. So if you set your origins to be ['https://example.com:6789'], it won’t find the origin in your array. If you set origins to ['example.com:6789'], then it should work (at least it did for me when I removed the scheme).

It seems an open question to the project authors whether this constitutes a bug.