braid-http 1.3.102 → 1.3.104

package/README.md

@@ -376,6 +376,14 @@ braid_fetch('/example', {multiplex: false, subscription: true})
 braid_fetch('/example', {multiplex: {after: 1}, subscription: true})
 ```
 
+Note that this library implements [optimistic multiplexing](https://braid.org/protocol/multiplexing#optimistic-creation), which is faster, but can print this harmless error message to your JS console:
+
+```
+GET /foo 424 (Multiplexer no exist; consider trying again)
+```
+
+You can ignore this message.
+
 ### Server
 
 Configure mutliplexing with:
@@ -385,27 +393,6 @@ var braidify = require('braid-http').http-server
 nbraidify.enable_multiplex = true   // or false
 ```
 
-### How CORS works with Multiplexing
-
-When multiplexing is enabled, the library presents the illusion that
-everything is normal HTTP.  Behind the scenes, a request/response pair is
-made to `.well-known/multiplexer/<id>` to establish the multiplexer
-channel — CORS is opened on this request.  However, this request is hidden
-from client code (it happens inside `braid_fetch`) and the response is
-hidden from server code (it happens inside `braidify`).
-
-One might worry that a cross-origin GET without proper CORS could trick the
-server into piping its response through the multiplexer channel — and since
-CORS is opened on the multiplexer channel, the client could read data it
-shouldn't have access to.  This doesn't happen, because the browser sends a
-preflight OPTIONS request before the actual GET.  If the server doesn't
-return the proper CORS headers for that OPTIONS request, the browser never
-sends the GET, and no data flows through the multiplexer channel.
-
-Multiplexer error responses (e.g. 424 "Multiplexer no exist" or 409
-"Request already multiplexed") also include CORS headers, so that browsers
-can read the error details from cross-origin requests.
-
 ## Testing
 
 Run all tests from the command line:

package/braid-http-server.js

@@ -289,8 +289,15 @@ function braidify (req, res, next) {
 
     // Parse the subscribe header
     var subscribe = req.headers.subscribe
-    if (subscribe === '' || subscribe === 'true')
-        subscribe = true
+    // If the subscribe header exists...
+    if ((subscribe === '' || subscribe)
+        // And this is a GET, because `Subscribe:` is only
+        // specified for GET thus far...
+        && req.method === 'GET')
+        // Then let's set 'subscribe' on.  We default to "true", but if the
+        // client actually specified a value other than empty string '', let's
+        // use that rich value.
+        subscribe = subscribe || true
 
     // Define convenience variables
     req.version   = version
@@ -399,7 +406,7 @@ function braidify (req, res, next) {
             free_cors(res)
             
             req.is_multiplexer = res.is_multiplexer = true
-            res.writeHead(424, 'Multiplexer no exist', {'Bad-Multiplexer': multiplexer})
+            res.writeHead(424, 'Multiplexer no exist; cosnsider trying again', {'Bad-Multiplexer': multiplexer})
             return res.end(`multiplexer ${multiplexer} does not exist`)
         }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "braid-http",
-  "version": "1.3.102",
+  "version": "1.3.104",
   "description": "An implementation of Braid-HTTP for Node.js and Browsers",
   "scripts": {
     "test": "node test/test.js",