Add an option to toggle handling of OPTIONS requests

[MiLk]

The kind of change this PR does introduce

• a bug fix
• a new feature
• an update to the documentation
• a code change that improves performance
• other

Current behaviour

OPTIONS request are processed by engine.io

New behaviour

By setting enableOptions to false, OPTIONS request are no longer processed by engine.io

Other information (e.g. related issues)

Related to #279

This allows to handle CORS ourselves:

var app = require('express')();
var cors = require('cors');
app.options('*', cors());
var server = require('http').Server(app);
var io = require('socket.io')(server, {
  enableOptions: false
});
io.on('connection', function(){ /* … */ });
server.listen(3000);

I've raised the PR against the 1.8.x branch, as it's the version used by socket.io at the moment.

[darrachequesne]

Thanks for the pull request!

What do you think of a handlePreflightRequest option, which could be either a boolean (what you're currently suggesting) or a function allowing the user to properly handle those OPTIONS requests?

var io = require('socket.io')(server, {
  handlePreflightRequest: false,
  // or
  handlePreflightRequest: (res, req) => {
    // set the proper headers
  } 
});

[MiLk]

That would work too. I will implement it tomorrow.

[MiLk]

You can now do:

var app = require('express')();
var server = require('http').Server(app);
var io = require('socket.io')(server, {
  handlePreflightRequest: (req, res) => {
    let headers = {};
    if (req.headers.origin) {
      headers['Access-Control-Allow-Credentials'] = 'true';
      headers['Access-Control-Allow-Origin'] = req.headers.origin;
     } else {
       headers['Access-Control-Allow-Origin'] = '*';
     }
     headers['Access-Control-Allow-Methods'] = 'GET,HEAD,PUT,PATCH,POST,DELETE';
     headers['Access-Control-Allow-Headers'] = 'origin, content-type, accept';
     res.writeHead(200, headers);
     res.end();
  }
});
io.on('connection', function(){ /* … */ });
server.listen(3000);

Or:

var app = require('express')();
var cors = require('cors');
app.options('*', cors());
var server = require('http').Server(app);
var io = require('socket.io')(server, {
  enableOptions: false
});
io.on('connection', function(){ /* … */ });
server.listen(3000);

[MiLk]

The last error on travis doesn't seem to be related to that PR.
https://travis-ci.org/socketio/engine.io/jobs/206487174

[darrachequesne]

@MiLk thanks a lot!