Fixing IE10 CORS test.

tools/testing/dart/http_server.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library http_server;
 
 import 'dart:async';
 import 'dart:io';
 import 'dart:isolate';
 import 'dart:uri';
@@ skipping 250 matching lines @@
     response.outputStream.writeString(footer);
     response.outputStream.close();
   }
 
   void _sendFileContent(HttpRequest request,
                         HttpResponse response,
                         int allowedPort,
                         Path path,
                         File file) {
     if (allowedPort != -1) {
-      var origin = new Uri(request.headers.value('Origin'));
-      // Allow loading from http://*:$allowedPort in browsers.
-      var allowedOrigin =
+      var headerOrigin = request.headers.value('Origin');
+      var allowedOrigin;
+      if (headerOrigin != null) {
+        var origin = new Uri(headerOrigin);
+        // Allow loading from http://*:$allowedPort in browsers.
+        allowedOrigin =
           '${origin.scheme}://${origin.domain}:${allowedPort}';
+      } else {
+        // IE10 appears to be bugged and is not sending the Origin header
+        // when making CORS requests to the same domain but different port.
+        allowedOrigin = '*';

[kustermann, 2013/03/16 22:41:19]

I think this is not the right approach:

You know probably more about CORS/... than I do, but AFAIK browsers should set
the 'Origin' header when they do a cross domain request. And servers (like this
http server) should be able to depend on 'Origin' -- if 'Origin' was not given a
server may want to deny access (and that is a sane behaviour).

If IE10 misbehaves sometimes then we should not change the test or the http
server. Instead we should mark the test in the status file as failing on IE10
and add a comment which says that IE10 is broken and causes the test to fail.

+      }
+
+
       response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
       response.headers.set('Access-Control-Allow-Credentials', 'true');
     } else {
       // No allowedPort specified. Allow from anywhere (but cross-origin
       // requests *with credentials* will fail because you can't use "*").
       response.headers.set("Access-Control-Allow-Origin", "*");
     }
     if (useContentSecurityPolicy) {
       // Chrome respects the standardized Content-Security-Policy header,
       // whereas Firefox and IE10 use X-Content-Security-Policy. Safari
@@ skipping 38 matching lines @@
 class _Entry {
   final String name;
   final String displayName;
 
   _Entry(this.name, this.displayName);
 
   int compareTo(_Entry other) {
     return name.compareTo(other.name);
   }
 }