From 8cbf7772325939a1fab1e5c6f1ce1518758a9c1d Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Fri, 8 Mar 2013 15:34:37 -0500
Subject: [PATCH 1/3] allow OPTIONS, req.headers.origin || *

---
 src/server/middleware.coffee | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/server/middleware.coffee b/src/server/middleware.coffee
index 0a16aad85a..902b8f3ec4 100644
--- a/src/server/middleware.coffee
+++ b/src/server/middleware.coffee
@@ -15,7 +15,8 @@ module.exports.view = (req, res, next) ->
 
 #CORS middleware
 module.exports.allowCrossDomain = (req, res, next) ->
-  res.header "Access-Control-Allow-Origin", '*'
-  res.header "Access-Control-Allow-Methods", "GET,PUT,POST,DELETE"
+  console.log req.headers.origin
+  res.header "Access-Control-Allow-Origin", (req.headers.origin || "*")
+  res.header "Access-Control-Allow-Methods", "OPTIONS,GET,PUT,POST,DELETE"
   res.header "Access-Control-Allow-Headers", "Content-Type,x-requested-with,x-api-user,x-api-key"
   next()
\ No newline at end of file

From 1ddd06ce38fe34ea0919452b583a098777e8fa9a Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Fri, 8 Mar 2013 15:39:03 -0500
Subject: [PATCH 2/3] remove webkit-agent (thought i already did?)

---
 server.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 51db9480cf..6412b78225 100644
--- a/server.js
+++ b/server.js
@@ -22,7 +22,7 @@ process.env.SMTP_SERVICE = conf.get("SMTP_SERVICE");
 process.env.STRIPE_API_KEY = conf.get("STRIPE_API_KEY");
 process.env.STRIPE_PUB_KEY = conf.get("STRIPE_PUB_KEY");
 
-var agent;
+/*var agent;
 if (process.env.NODE_ENV === 'development') {
     // Follow these instructions for profiling / debugging leaks
     // * https://developers.google.com/chrome-developer-tools/docs/heap-profiling
@@ -31,7 +31,7 @@ if (process.env.NODE_ENV === 'development') {
     console.log("To debug memory leaks:" +
         "\n\t(1) Run `kill -SIGUSR2 " + process.pid + "`" +
         "\n\t(2) open http://c4milo.github.com/node-webkit-agent/21.0.1180.57/inspector.html?host=localhost:1337&page=0");
-}
+}*/
 
 process.on('uncaughtException', function (error) {
 

From 399e4b9ddafb4174f98e8cb55139e8b74359a57e Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Fri, 8 Mar 2013 18:04:57 -0500
Subject: [PATCH 3/3] strange fix to CORS issue - move CORS middleware to top,
 respond with 200 if OPTIONS request

---
 src/server/index.coffee      |  2 +-
 src/server/middleware.coffee | 10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/server/index.coffee b/src/server/index.coffee
index 8fc29583a8..f09668dee0 100644
--- a/src/server/index.coffee
+++ b/src/server/index.coffee
@@ -57,6 +57,7 @@ auth.store(store, habitrpgStore.customAccessControl)
 
 mongo_store = new MongoStore {url: process.env.NODE_DB_URI}, ->
   expressApp
+    .use(middleware.allowCrossDomain)
     .use(express.favicon("#{publicPath}/favicon.ico"))
     # Gzip static files and serve from memory
     .use(gzippo.staticGzip(publicPath, maxAge: ONE_YEAR))
@@ -74,7 +75,6 @@ mongo_store = new MongoStore {url: process.env.NODE_DB_URI}, ->
     )
     # Adds req.getModel method
     .use(store.modelMiddleware())
-    .use(middleware.allowCrossDomain)
     # API should be hit before all other routes
     .use('/api/v1', require('./api').middleware)
     .use(require('./deprecated').middleware)
diff --git a/src/server/middleware.coffee b/src/server/middleware.coffee
index 902b8f3ec4..56c6bf16fb 100644
--- a/src/server/middleware.coffee
+++ b/src/server/middleware.coffee
@@ -17,6 +17,10 @@ module.exports.view = (req, res, next) ->
 module.exports.allowCrossDomain = (req, res, next) ->
   console.log req.headers.origin
   res.header "Access-Control-Allow-Origin", (req.headers.origin || "*")
-  res.header "Access-Control-Allow-Methods", "OPTIONS,GET,PUT,POST,DELETE"
-  res.header "Access-Control-Allow-Headers", "Content-Type,x-requested-with,x-api-user,x-api-key"
-  next()
\ No newline at end of file
+  res.header "Access-Control-Allow-Methods", "OPTIONS,GET,POST,PUT,HEAD,DELETE"
+  res.header "Access-Control-Allow-Headers", "Content-Type,X-Requested-With,x-api-user,x-api-key"
+
+  if req.method is 'OPTIONS'
+    res.send(200);
+  else
+    next()
\ No newline at end of file