From b35a6f5ffb575d062663d2ddb47eec04021a8639 Mon Sep 17 00:00:00 2001
From: Rob Wu <gwnRob@gmail.com>
Date: Tue, 23 Jul 2013 21:44:41 +0200
Subject: [PATCH] Redirect URL in statusText

Android's stock browser (and Webview) does not recognize the
Access-Control-Expose-headers response header.
Use the status text field to pass through this information.

Updated demo and documentation.
---
 README.md            | 12 +++++++++---
 demo.html            | 12 +++++++-----
 lib/cors-anywhere.js |  7 ++++++-
 lib/help.txt         |  5 ++++-
 4 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index e7a7062..ce9d67d 100644
--- a/README.md
+++ b/README.md
@@ -41,12 +41,18 @@ Request examples:
 
 Live examples:
 
-* http://cors-anywhere.herokuapp.com/
-* http://rob.lekensteyn.nl/cors-anywhere.html - This demo shows how to use the API.
+* https://cors-anywhere.herokuapp.com/
+* https://robwu.nl/cors-anywhere.html - This demo shows how to use the API.
   Includes a redirect handler (including loop detection) and shows that the POST also works.
 
 ## Documentation
 
+### Client
+
+Learn how to use the API in a web app by viewing the source code of [demo.html](demo.html) and reading [lib/help.txt](lib/help.txt).
+
+### Server
+
 The module exports two properties: `getHandler` and `createServer`.
 
 * `getHandler(options)` returns a handler which implements the routing logic.
@@ -71,7 +77,7 @@ The following options are recognized by both methods:
 
 ## License
 
-Copyright (C) 2013 Rob W <gwnRob@gmail.com>
+Copyright (C) 2013 Rob Wu <gwnRob@gmail.com>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in
diff --git a/demo.html b/demo.html
index 194df67..7c69de0 100644
--- a/demo.html
+++ b/demo.html
@@ -48,7 +48,7 @@ textarea {
 <div id="top">
   CORS Anywhere demo &bull; <a href="https://github.com/Rob--W/cors-anywhere/">Github</a> &bull; <a href="http://cors-anywhere.herokuapp.com">Live server</a>.
   <label>
-    Url to be fetched (example: <a href="//rob.lekensteyn.nl/dump.php">rob.lekensteyn.nl/dump.php</a>)
+    Url to be fetched (example: <a href="//robwu.nl/dump.php">robwu.nl/dump.php</a>)
     <input type="url" id="url" value="">
   </label>
   <label>
@@ -64,7 +64,8 @@ textarea {
 </div>
 
 <script>
-  var cors_api_url = 'http://cors-anywhere.herokuapp.com/'; // https is also supported
+  var protocol = location.protocol === 'http:' ? 'http:' : 'https:';
+  var cors_api_url = protocol + '//cors-anywhere.herokuapp.com/';
   function doCORSRequest(options, redirectCount) {
     var x = new XMLHttpRequest();
     x.open(options.method, cors_api_url + options.url);
@@ -73,9 +74,10 @@ textarea {
     x.onload = function() {
       if (x.status === 333) {
         redirectCount = +redirectCount ? +redirectCount + 1 : 1;
-        var url = x.getResponseHeader('Location');
-        if (url && redirectCount <= 5) {
-          var originalStatus = +/\d+/.exec(x.statusText);
+        var redirectInfo = /^(\d+) (.*)$/.exec(x.statusText);
+        if (redirectInfo && redirectCount <= 5) {
+          var originalStatus = +redirectInfo[1];
+          var url = redirectInfo[2];
           if (originalStatus === 307 || originalStatus === 308) {
             // Correctly deal with method-preserving redirects
             options.url = url;
diff --git a/lib/cors-anywhere.js b/lib/cors-anywhere.js
index 0821236..eb1d503 100644
--- a/lib/cors-anywhere.js
+++ b/lib/cors-anywhere.js
@@ -1,6 +1,9 @@
 // © 2013 Rob W <gwnRob@gmail.com>
 // Released under the MIT license
 
+'use strict';
+/* jshint node:true, eqnull:true, sub:true */
+
 var httpProxy = require('http-proxy');
 var net = require('net');
 var url = require('url');
@@ -83,8 +86,10 @@ function proxyRequest(req, res, proxy, full_url, proxyOptions) {
         if (headers['location']) {
           headers['location'] = url.resolve(full_url, headers['location']);
         }
+        // Put redirect URL in status text so that user agents that do not recognize the Access-Control-Expose-Headers
+        // response header can still read the target URL.
+        reasonPhrase = statusCode + ' ' + (headers['location'] || '');
         // Don't use 301 or 302 because browsers may cancel the request (observed in Chrome with a custom request header)
-        reasonPhrase = 'Redirect ' + statusCode;
         statusCode = 333;
       }
 
diff --git a/lib/help.txt b/lib/help.txt
index 9838312..6f74e35 100644
--- a/lib/help.txt
+++ b/lib/help.txt
@@ -13,6 +13,9 @@ Cookies are disabled and stripped from requests.
 Redirects are not automatically followed: The API response has status code 333.
 The client ought to confirm this redirection by creating a new request (the url
 is available in the Location response header).
+For user agents who do not support the Access-Control-Expose-Headers response header,
+the information is available in the status text as "<HTTP STATUS CODE> <LOCATION HEADER>".
+
 
 The requested URL is available in the X-Request-URL response header. Non-existence of this
 header implies that the requested URL was not recognized.
@@ -20,5 +23,5 @@ header implies that the requested URL was not recognized.
 This API has one requirement: The X-Requested-With header must be set.
 
 
-Demo        :   http://rob.lekensteyn.nl/cors-anywhere.html
+Demo        :   https://robwu.nl/cors-anywhere.html
 Source code :   https://github.com/Rob--W/cors-anywhere/