braid-http 1.3.101 → 1.3.103

package/README.md

@@ -385,23 +385,6 @@ var braidify = require('braid-http').http-server
 nbraidify.enable_multiplex = true   // or false
 ```
 
-### How CORS works with Multiplexing
-
-When multiplexing is enabled, the library presents the illusion that
-everything is normal HTTP.  Behind the scenes, a request/response pair is
-made to `.well-known/multiplexer/<id>` to establish the multiplexer
-channel — CORS is opened on this request.  However, this request is hidden
-from client code (it happens inside `braid_fetch`) and the response is
-hidden from server code (it happens inside `braidify`).
-
-One might worry that a cross-origin GET without proper CORS could trick the
-server into piping its response through the multiplexer channel — and since
-CORS is opened on the multiplexer channel, the client could read data it
-shouldn't have access to.  This doesn't happen, because the browser sends a
-preflight OPTIONS request before the actual GET.  If the server doesn't
-return the proper CORS headers for that OPTIONS request, the browser never
-sends the GET, and no data flows through the multiplexer channel.
-
 ## Testing
 
 Run all tests from the command line:

package/braid-http-server.js

@@ -289,8 +289,15 @@ function braidify (req, res, next) {
 
     // Parse the subscribe header
     var subscribe = req.headers.subscribe
-    if (subscribe === '' || subscribe === 'true')
-        subscribe = true
+    // If the subscribe header exists...
+    if ((subscribe === '' || subscribe)
+        // And this is a GET, because `Subscribe:` is only
+        // specified for GET thus far...
+        && req.method === 'GET')
+        // Then let's set 'subscribe' on.  We default to "true", but if the
+        // client actually specified a value other than empty string '', let's
+        // use that rich value.
+        subscribe = subscribe || true
 
     // Define convenience variables
     req.version   = version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "braid-http",
-  "version": "1.3.101",
+  "version": "1.3.103",
   "description": "An implementation of Braid-HTTP for Node.js and Browsers",
   "scripts": {
     "test": "node test/test.js",