Fix signout for IDE

node_modules/connect-architect/connect.cors/cors.js

@@ -11,6 +11,7 @@ module.exports = function(options, imports, register) {
 function cors(origin, options) {
     return function(req, res, next) {
         options = options || {};
+        var whitelist = options.whitelist || [];
         var writeHead = res.writeHead;
 
         res.writeHead = function(status, headers) {
@@ -20,6 +21,18 @@ function cors(origin, options) {
                 if (key.toLowerCase().indexOf("access-control") === 0)
                     delete(headers[key]);
 
+            if (req.headers.origin) {
+                var hasHostName = whitelist.some(function(hostname) {
+                    return req.headers.origin.match(new RegExp(hostname.replace(".", "\\.") + "$"));
+                });
+                
+                if (whitelist.length && !hasHostName)
+                    return writeHead.call(res, status, headers);
+                    
+                if (hasHostName)
+                    origin = req.headers.origin;
+            }
+                
             headers["Access-Control-Allow-Origin"] = origin;
             headers["Access-Control-Allow-Methods"] = options.methods || "GET, OPTIONS";
             if (options.headers)
@@ -38,7 +51,7 @@ function cors(origin, options) {
             res.end();
             return;
         }
-
+    
         next();
     };
 }

plugins/c9.core/http-xhr.js

@@ -78,6 +78,10 @@ define(function(require, module, exports) {
                 }
             }
             
+            if (options.withCredentials) {
+                xhr.withCredentials = true;
+            }
+            
             var timer;
             var timedout = false;
             if (timeout) {

plugins/c9.ide.auth/auth.js

@@ -113,7 +113,8 @@ define(function(require, exports, module) {
 
             http.request("/_auth/logout", function(err1) {
                 http.request(ideBaseUrl + "/auth/signout", {
-                    method: "POST"
+                    method: "POST",
+                    withCredentials: true
                 }, function(err2) {
                     loggedIn = false;
                     emit("logout", {uid: uid, newUid: ANONYMOUS});