From 03b2a875b8b4a5c2463d4a895559e24aa7feb837 Mon Sep 17 00:00:00 2001
From: Mark Donnelly <mark@painless-security.com>
Date: Mon, 24 Nov 2014 16:07:15 -0500
Subject: [PATCH] Use location.hostname as part of the name of the other end;
 reorder calls for debuggability.

The location.host includes the port number in the URL, if specified; the hostname does not.
The reordering of calls makes it easier to tell whether the crash is happening during a 200/Success or 401/Unauthorized response.
---
 navigator.gssweb.js | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/navigator.gssweb.js b/navigator.gssweb.js
index 0ff0f13..3027f97 100644
--- a/navigator.gssweb.js
+++ b/navigator.gssweb.js
@@ -68,7 +68,7 @@ var GSSWeb = (function () {
 
   GSSWeb.prototype.authGetServerName = function () {
     this.gss.import_name({
-      name: "HTTP@" + window.location.host,
+      name: "HTTP@" + window.location.hostname,
       success: this.authReceiveServerName.bind(this)
     });
   };
@@ -153,11 +153,10 @@ var GSSWeb = (function () {
       return;
     }
 
-    var serverResponse = JSON.parse(this.xhr.responseText);
-    this.serverToken = serverResponse.gssweb.token;
     switch (this.xhr.status) {
       case 200:
         // Finished!
+        var serverResponse = JSON.parse(this.xhr.responseText);
         var decoded = window.atob(serverResponse.application.data);
         this.authenticationState = true;
         this.success(
@@ -168,12 +167,14 @@ var GSSWeb = (function () {
         break;
       case 401:
         // Continue needed
+        var serverResponse = JSON.parse(this.xhr.responseText);
+        this.serverToken = serverResponse.gssweb.token;
         this.authInitSecContext();
         break;
       default:
         // We have some server-reported error
         this.error(
-          window.location.host + 
+          window.location.hostname + 
           " reported an error; aborting",
           this.appTag
         );
-- 
2.1.4