Trying to run cors-anywhere locally

php/header.php

@@ -6,7 +6,6 @@
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 
 <title>Zöff</title>
-
 <meta name="author" content="Nicolas 'Nixo' Almagro Tonne &amp; Kasper 'KasperRT' Rynning-Tønnesen"/>
 <meta name="description" content="The Shared (free) YouTube radio. Being built around the YouTube search and video API it enables the creation of collaborative and shared live playlists, with billions of videos and songs to choose from, all for free and without registration. Enjoy!"/>
 <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=no"/>

server/node_modules/cors-anywhere/.jshintrc

@@ -0,0 +1,7 @@
+{
+    "node": true,
+    "eqnull": true,
+    "undef": true,
+    "unused": "vars",
+    "mocha": true
+}

server/node_modules/cors-anywhere/.npmignore

@@ -0,0 +1,7 @@
+*.swp
+*.kate-swp
+*.tmp
+*.log
+
+del/
+node_modules/

server/node_modules/cors-anywhere/Procfile

@@ -0,0 +1 @@
+web: node server.js

server/node_modules/cors-anywhere/README.md

@@ -0,0 +1,130 @@
+**CORS Anywhere** is a NodeJS proxy which adds CORS headers to the proxied request.
+
+The url to proxy is literally taken from the path, validated and proxied. The protocol
+part of the proxied URI is optional, and defaults to "http". If port 443 is specified,
+the protocol defaults to "https".
+
+This package does not put any restrictions on the http methods or headers, except for
+cookies. Requesting [user credentials](http://www.w3.org/TR/cors/#user-credentials) is disallowed.
+The app can be configured to require a header for proxying a request, for example to avoid
+a direct visit from the browser.
+
+The package also includes a Procfile, to run the app on Heroku. More information about
+Heroku can be found at https://devcenter.heroku.com/articles/nodejs.
+
+## Example
+
+```javascript
+// Heroku defines the environment variable PORT, and requires the binding address to be 0.0.0.0
+var host = process.env.PORT ? '0.0.0.0' : '127.0.0.1';
+var port = process.env.PORT || 8080;
+
+var cors_proxy = require('cors-anywhere');
+cors_proxy.createServer({
+    requireHeader: ['origin', 'x-requested-with'],
+    removeHeaders: ['cookie', 'cookie2']
+}).listen(port, host, function() {
+    console.log('Running CORS Anywhere on ' + host + ':' + port);
+});
+
+```
+Request examples:
+
+* `http://localhost:8080/http://google.com/` - Google.com with CORS headers
+* `http://localhost:8080/google.com` - Same as previous.
+* `http://localhost:8080/google.com:443` - Proxies `https://google.com/`
+* `http://localhost:8080/` - Shows usage text, as defined in `libs/help.txt`
+* `http://localhost:8080/favicon.ico` - Replies 404 Not found
+
+Live examples:
+
+* https://cors-anywhere.herokuapp.com/
+* https://robwu.nl/cors-anywhere.html - This demo shows how to use the API.
+
+## Documentation
+
+### Client
+
+To use the API, just prefix the URL with the API URL. Take a look at [demo.html](demo.html) for an example.
+A concise summary of the documentation is provided at [lib/help.txt](lib/help.txt).
+
+If you want to automatically enable cross-domain requests when needed, use the following snippet:
+
+```javascript
+(function() {
+    var cors_api_host = 'cors-anywhere.herokuapp.com';
+    var cors_api_url = 'https://' + cors_api_host + '/';
+    var slice = [].slice;
+    var origin = window.location.protocol + '//' + window.location.host;
+    var open = XMLHttpRequest.prototype.open;
+    XMLHttpRequest.prototype.open = function() {
+        var args = slice.call(arguments);
+        var targetOrigin = /^https?:\/\/([^\/]+)/i.exec(args[1]);
+        if (targetOrigin && targetOrigin[0].toLowerCase() !== origin &&
+            targetOrigin[1] !== cors_api_host) {
+            args[1] = cors_api_url + args[1];
+        }
+        return open.apply(this, args);
+    };
+})();
+```
+
+If you're using jQuery, you can also use the following code **instead of** the previous one:
+
+```javascript
+jQuery.ajaxPrefilter(function(options) {
+    if (options.crossDomain && jQuery.support.cors) {
+        options.url = 'https://cors-anywhere.herokuapp.com/' + options.url;
+    }
+});
+```
+
+### Server
+
+The module exports two properties: `getHandler` and `createServer`.
+
+* `getHandler(options)` returns a handler which implements the routing logic.
+  This handler is used by [http-proxy](https://github.com/nodejitsu/node-http-proxy).
+* `createServer(options)` creates a server with the default handler.
+
+The following options are recognized by both methods:
+
+* array of strings `requireHeader` - If set, the request must include this header or the API will refuse to proxy.  
+  Recommended if you want to prevent users from using the proxy for normal browsing.  
+  Example: `['Origin', 'X-Requested-With']`.
+* array of lowercase strings `removeHeaders` - Exclude certain headers from being included in the request.  
+  Example: `["cookie"]`
+
+`createServer` recognizes the following option as well:
+
+* `httpProxyOptions` - Options for http-proxy. The documentation for these options can be found [here](https://github.com/nodejitsu/node-http-proxy#options).
+* `httpsOptions` - If set, a `https.Server` will be created. The given options are passed to the
+  [`https.createServer`](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener) method.
+
+
+## Dependencies
+
+- NodeJitsu's [http-proxy](https://github.com/nodejitsu/node-http-proxy)
+
+
+## License
+
+Copyright (C) 2013 - 2015 Rob Wu <rob@robwu.nl>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

server/node_modules/cors-anywhere/demo.html

@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Demo of CORS Anywhere</title>
+<meta name="viewport" content="width=device-width">
+<style>
+html, body {
+  margin: 0;
+  height: 100%;
+  padding: 3px;
+  font-family: Arial, sans-serif;
+  font-size: 16px;
+}
+* {
+  -moz-box-sizing: border-box;
+       box-sizing: border-box;
+}
+label { display: block; }
+input {
+  display: block;
+  width: 100%;
+  padding: 8px 5px;
+  border: 1px solid #CCC;
+}
+button {
+  display: inline-block;
+  width: 49%;
+  padding: 8px;
+}
+textarea {
+  width: 100%;
+  height: 100%;
+}
+#top {
+  height: 180px;
+  position: relative;
+
+}
+#bottom {
+  height: 100%;
+  margin-top: -180px;
+  padding-top: 180px;
+}
+</style>
+</head>
+<body>
+<div id="top">
+  CORS Anywhere demo &bull; <a href="https://github.com/Rob--W/cors-anywhere/">Github</a> &bull; <a href="http://cors-anywhere.herokuapp.com">Live server</a>.
+  <label>
+    Url to be fetched (example: <a href="//robwu.nl/dump.php">robwu.nl/dump.php</a>)
+    <input type="url" id="url" value="">
+  </label>
+  <label>
+    If using POST, enter the data:
+    <input type="text" id="data">
+  </label>
+  <label>
+    <button id="get">GET</button><button id="post">POST</button>
+  </label>
+</div>
+<div id="bottom">
+  <textarea id="output"></textarea>
+</div>
+
+<script>
+  var cors_api_url = 'https://cors-anywhere.herokuapp.com/';
+  function doCORSRequest(options, printResult) {
+    var x = new XMLHttpRequest();
+    x.open(options.method, cors_api_url + options.url);
+    x.onload = x.onerror = function() {
+      printResult(
+        options.method + ' ' + options.url + '\n' +
+        x.status + ' ' + x.statusText + '\n\n' +
+        (x.responseText || '')
+      );
+    };
+    if (/^POST/i.test(options.method)) {
+      x.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
+    }
+    x.send(options.data);
+  }
+
+  // Bind event
+  (function() {
+    var urlField = document.getElementById('url');
+    var dataField = document.getElementById('data');
+    var outputField = document.getElementById('output');
+    document.getElementById('get').onclick =
+    document.getElementById('post').onclick = function(e) {
+      e.preventDefault();
+      doCORSRequest({
+        method: this.id === 'post' ? 'POST' : 'GET',
+        url: urlField.value,
+        data: dataField.value
+      }, function printResult(result) {
+        outputField.value = result;
+      });
+    };
+  })();
+  if (typeof console === 'object') {
+    console.log('// To test a local CORS Anywhere server, set cors_api_url. For example:');
+    console.log('cors_api_url = "http://localhost:8080/"');
+  }
+</script>
+</body>
+</html>

server/node_modules/cors-anywhere/leaktest.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# step 1a: Start test server
+# node ~/node/quick-server/redirect-print.js
+# step 1b: webkit devtools frontend
+# in ~/lib/node-webkit-devtools/
+
+# step 2: start proxy with debugging
+# node server.js
+
+# step 3: refresh devtools frontend in browser
+# See README.txt of step 1b
+
+# step 4: Test
+
+if [ $# -eq 0 ] ; then # no args
+    echo "Test with redirect"
+    for i in {1..100} ; do curl -s 'http://127.0.0.1:8080/http://127.0.0.1:1302/xxx' -H 'Origin: x' -o /dev/null ; done
+else
+    echo "Test without redirect"
+    for i in {1..100} ; do curl -s 'http://127.0.0.1:8080/http://127.0.0.1:1302/' -H 'Origin: x' -o /dev/null ; done
+fi
+
+# step 5: Check for leak

server/node_modules/cors-anywhere/lib/cors-anywhere.js

@@ -0,0 +1,331 @@
+// © 2013 - 2015 Rob Wu <rob@robwu.nl>
+// Released under the MIT license
+
+'use strict';
+
+var httpProxy = require('http-proxy');
+var net = require('net');
+var url = require('url');
+var regexp_tld = require('./regexp-top-level-domain');
+
+var help_file = __dirname + '/help.txt';
+var help_text;
+function showUsage(headers, response) {
+  headers['content-type'] = 'text/plain';
+  if (help_text != null) {
+    response.writeHead(200, headers);
+    response.end(help_text);
+  } else {
+    require('fs').readFile(help_file, 'utf8', function(err, data) {
+      if (err) {
+        console.error(err);
+        response.writeHead(500, headers);
+        response.end();
+      } else {
+        help_text = data;
+        showUsage(headers, response); // Recursive call, but since data is a string, the recursion will end
+      }
+    });
+  }
+}
+
+/**
+ * Check whether the specified hostname is valid.
+ *
+ * @param hostname {string} Host name (excluding port) of requested resource.
+ * @return {boolean} Whether the requested resource can be accessed.
+ */
+function isValidHostName(hostname) {
+  return !!(
+    regexp_tld.test(hostname) ||
+    net.isIPv4(hostname) ||
+    net.isIPv6(hostname)
+  );
+}
+
+/**
+ * Adds CORS headers to the response headers.
+ *
+ * @param headers {object} Response headers
+ * @param request {ServerRequest}
+ */
+function withCORS(headers, request) {
+  headers['access-control-allow-origin'] = '*';
+  if (request.headers['access-control-request-method']) {
+    headers['access-control-allow-methods'] = request.headers['access-control-request-method'];
+    delete request.headers['access-control-request-method'];
+  }
+  if (request.headers['access-control-request-headers']) {
+    headers['access-control-allow-headers'] = request.headers['access-control-request-headers'];
+    delete request.headers['access-control-request-headers'];
+  }
+
+  headers['access-control-expose-headers'] = Object.keys(headers).join(',');
+
+  return headers;
+}
+
+/**
+ * Performs the actual proxy request.
+ *
+ * @param req {ServerRequest} Incoming http request
+ * @param res {ServerResponse} Outgoing (proxied) http request
+ * @param proxy {HttpProxy}
+ */
+function proxyRequest(req, res, proxy) {
+  var location = req.corsAnywhereRequestState.location;
+
+  req.url = location.path;
+
+  // Start proxying the request
+  proxy.web(req, res, {
+    changeOrigin: true,
+    prependPath: false,
+    target: location
+  });
+}
+
+/**
+ * "Allow observer to modify headers or abort response"
+ * https://github.com/nodejitsu/node-http-proxy/blob/v1.11.1/lib/http-proxy/passes/web-incoming.js#L147
+ * 
+ * This method modifies the response headers of the proxied response.
+ * If a redirect is detected, the response is not sent to the client,
+ * and a new request is initiated.
+ * 
+ * @param response {ClientRequest} The response of the proxied request
+ * @param req {IncomingMessage} Incoming HTTP request, augmented with property corsAnywhereRequestState
+ * @param req.corsAnywhereRequestState {object}
+ * @param req.corsAnywhereRequestState.location {object} See parseURL
+ * @param req.corsAnywhereRequestState.proxyBaseUrl {string} Base URL of the CORS API endpoint
+ * @param req.corsAnywhereRequestState.maxRedirects {number} Maximum number of redirects
+ * @param req.corsAnywhereRequestState.redirectCount_ {number} Internally used to count redirects
+ * @param res {ServerResponse} Outgoing (proxied) HTTP request
+ *
+ * @this {HttpProxy}
+ */
+function onProxyResponse(response, req, res) {
+  /* jshint validthis:true */
+  var proxy = this;
+  var requestState = req.corsAnywhereRequestState;
+
+  var statusCode = response.statusCode;
+
+  if (!requestState.redirectCount_) {
+    res.setHeader('x-request-url', requestState.location.href);
+  }
+  // Handle redirects
+  if (statusCode === 301 || statusCode === 302 || statusCode === 303 || statusCode === 307 || statusCode === 308) {
+    var locationHeader = response.headers.location;
+    if (locationHeader) {
+      locationHeader = url.resolve(requestState.location.href, locationHeader);
+
+      if (statusCode === 301 || statusCode === 302 || statusCode === 303) {
+        // Exclude 307 & 308, because they are rare, and require preserving the method + request body
+        requestState.redirectCount_ = requestState.redirectCount_ + 1 || 1;
+        if (requestState.redirectCount_ <= requestState.maxRedirects) {
+          // Handle redirects within the server, because some clients (e.g. Android Stock Browser)
+          // cancel redirects.
+          // Set header for debugging purposes. Do not try to parse it!
+          res.setHeader('X-CORS-Redirect-' + requestState.redirectCount_, statusCode + ' ' + locationHeader);
+          
+          req.method = 'GET';
+          req.headers['content-length'] = '0';
+          delete req.headers['content-type'];
+          requestState.location = parseURL(locationHeader);
+
+          // ### Dispose the current proxied request
+          // Haha - hack! This should be fixed when (if?) node-http-proxy supports cancelation of requests..
+          // Shadow all methods that mutate the |res| object.
+          // See https://github.com/nodejitsu/node-http-proxy/blob/v1.11.1/lib/http-proxy/passes/web-outgoing.js#L73-L100
+          var setHeader = res.setHeader;
+          var writeHead = res.writeHead;
+          res.setHeader = res.writeHead = function noop() {};
+          response.on = function noop2() {};
+          response.pipe = function(res) {
+              res.setHeader = setHeader;
+              res.writeHead = writeHead;
+              // Trigger proxyReq.abort() (this is not of any imporance, it's just used to stop wasting resources.)
+              // https://github.com/nodejitsu/node-http-proxy/blob/v1.11.1/lib/http-proxy/passes/web-incoming.js#L125-L128
+              req.emit('aborted');
+              // Remove all listeners (=reset events to initial state)
+              req.removeAllListeners();
+              // Initiate a new proxy request.
+              proxyRequest(req, res, proxy);
+          };
+          return;
+        }
+      }
+      response.headers.location = requestState.proxyBaseUrl + '/' + locationHeader;
+    }
+  }
+
+  // Strip cookies
+  delete response.headers['set-cookie'];
+  delete response.headers['set-cookie2'];
+
+  response.headers['x-final-url'] = requestState.location.href;
+  withCORS(response.headers, req);
+}
+
+
+/**
+ * @param req_url {string} The requested URL (scheme is optional).
+ * @return {object} URL parsed using url.parse
+ */
+function parseURL(req_url) {
+  var match = req_url.match(/^(?:(https?:)?\/\/)?(([^\/?]+?)(?::(\d{0,5})(?=[\/?]|$))?)([\/?][\S\s]*|$)/i);
+  //                              ^^^^^^^          ^^^^^^^^      ^^^^^^^                ^^^^^^^^^^^^
+  //                            1:protocol       3:hostname     4:port                 5:path + query string
+  //                                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  //                                            2:host
+  if (!match) {
+    return null;
+  }
+  if (!match[1]) {
+    // scheme is omitted.
+    if (req_url.lastIndexOf('//', 0) === -1) {
+      // "//" is omitted.
+      req_url = '//' + req_url;
+    }
+    req_url = (match[4] == '443' ? 'https:' : 'http:') + req_url;
+  }
+  return url.parse(req_url);
+}
+
+// Request handler factory
+var getHandler = exports.getHandler = function(options, proxy) {
+  var corsAnywhere = {
+    maxRedirects: 5,          // Maximum number of redirects to be followed.
+    requireHeader: null,      // Require a header to be set?
+    removeHeaders: []         // Strip these request headers
+  };
+  if (options) {
+    Object.keys(corsAnywhere).forEach(function(option) {
+      if (Object.prototype.hasOwnProperty.call(options, option)) {
+        corsAnywhere[option] = options[option];
+      }
+    });
+  }
+  // Convert corsAnywhere.requireHeader to an array of lowercase header names, or null.
+  if (corsAnywhere.requireHeader) {
+    if (typeof corsAnywhere.requireHeader === 'string') {
+      corsAnywhere.requireHeader = [corsAnywhere.requireHeader];
+    } else if (!Array.isArray(corsAnywhere.requireHeader) || corsAnywhere.requireHeader.length === 0) {
+      corsAnywhere.requireHeader = null;
+    } else {
+      corsAnywhere.requireHeader = corsAnywhere.requireHeader.map(function(headerName) {
+        return headerName.toLowerCase();
+      });
+    }
+  }
+  var hasRequiredHeaders = function(headers) {
+    return !corsAnywhere.requireHeader || corsAnywhere.requireHeader.some(function(headerName) {
+      return Object.hasOwnProperty.call(headers, headerName);
+    });
+  };
+
+  return function(req, res) {
+    var cors_headers = withCORS({}, req);
+    if (req.method == 'OPTIONS') {
+      // Pre-flight request. Reply successfully:
+      res.writeHead(200, cors_headers);
+      res.end();
+      return;
+    }
+
+    var location = parseURL(req.url.slice(1));
+
+    if (!location) {
+      // Invalid API call. Show how to correctly use the API
+      showUsage(cors_headers, res);
+      return;
+    }
+
+    if (location.host === 'iscorsneeded') {
+      // Is CORS needed? This path is provided so that API consumers can test whether it's necessary
+      // to use CORS. The server's reply is always No, because if they can read it, then CORS headers
+      // are not necessary.
+      res.writeHead(200, {'Content-Type': 'text/plain'});
+      res.end('no');
+      return;
+    }
+
+    if (location.port > 65535) {
+      // Port is higher than 65535
+      res.writeHead(400, 'Invalid port', cors_headers);
+      res.end('Port number too large: ' + location.port);
+      return;
+    }
+
+    if (!/^\/https?:/.test(req.url) && !isValidHostName(location.hostname)) {
+      // Don't even try to proxy invalid hosts (such as /favicon.ico, /robots.txt)
+      res.writeHead(404, 'Invalid host', cors_headers);
+      res.end('Invalid host: ' + location.hostname);
+      return;
+    }
+
+    if (!hasRequiredHeaders(req.headers)) {
+      res.writeHead(400, 'Header required', cors_headers);
+      res.end('Missing required request header. Must specify one of: ' + corsAnywhere.requireHeader);
+      return;
+    }
+
+    var isRequestedOverHttps = req.connection.encrypted || /^\s*https/.test(req.headers['x-forwarded-proto']);
+    var proxyBaseUrl = (isRequestedOverHttps ? 'https://' : 'http://') + req.headers.host;
+
+    corsAnywhere.removeHeaders.forEach(function(header) {
+      delete req.headers[header];
+    });
+
+
+    req.corsAnywhereRequestState = {
+      location: location,
+      maxRedirects: corsAnywhere.maxRedirects,
+      proxyBaseUrl: proxyBaseUrl
+    };
+
+    proxyRequest(req, res, proxy);
+  };
+};
+
+// Create server with default and given values
+// Creator still needs to call .listen()
+exports.createServer = function createServer(options) {
+  if (!options) options = {};
+
+  // Default options:
+  var httpProxyOptions = {
+    xfwd: true,            // Append X-Forwarded-* headers
+  };
+  // Allow user to override defaults and add own options
+  if (options.httpProxyOptions) {
+    Object.keys(options.httpProxyOptions).forEach(function(option) {
+      httpProxyOptions[option] = options.httpProxyOptions[option];
+    });
+  }
+
+  var proxy = httpProxy.createServer(httpProxyOptions);
+  var requestHandler = getHandler(options, proxy);
+  var server;
+  if (options.httpsOptions) {
+    server = require('https').createServer(options.httpsOptions, requestHandler);
+  } else {
+    server = require('http').createServer(requestHandler);
+  }
+
+  // When the server fails, just show a 404 instead of Internal server error
+  proxy.on('error', function(err, req, res) {
+    if (res._headerSent) {
+      // E.g. when the server replies with an invalid Content-Length value,
+      // causing the response to end as expected while triggering the
+      // "HPE_INVALID_CONSTANT" error.
+      return;
+    }
+    res.writeHead(404, {'Access-Control-Allow-Origin': '*'});
+    res.end('Not found because of proxy error: ' + err);
+  });
+  proxy.on('proxyRes', onProxyResponse);
+
+  return server;
+};

server/node_modules/cors-anywhere/lib/help.txt

@@ -0,0 +1,30 @@
+This API enables cross-origin requests to anywhere.
+
+Usage:
+
+/               Shows help
+/iscorsneeded   This is the only resource on this host which is served without CORS headers.
+/<url>          Create a request to <url>, and includes CORS headers in the response.
+
+If the protocol is omitted, it defaults to http (https if port 443 is specified).
+
+Cookies are disabled and stripped from requests.
+
+Redirects are automatically followed. For debugging purposes, each followed redirect results
+in the addition of a X-CORS-Redirect-n header, where n starts at 1. These headers are not
+accessible by the XMLHttpRequest API.
+After 5 redirects, redirects are not followed any more. The redirect response is sent back
+to the browser, which can choose to follow the redirect (handled automatically by the browser).
+
+The requested URL is available in the X-Request-URL response header.
+The final URL, after following all redirects, is available in the X-Final-URL response header.
+
+
+To prevent the use of the proxy for casual browsing, the API requires either the Origin
+or the X-Requested-With header to be set. To avoid unnecessary preflight (OPTIONS) requests,
+it's recommended to not manually set these headers in your code.
+
+
+Demo          :   https://robwu.nl/cors-anywhere.html
+Source code   :   https://github.com/Rob--W/cors-anywhere/
+Documentation :   https://github.com/Rob--W/cors-anywhere/#documentation

server/node_modules/cors-anywhere/node_modules/http-proxy/.npmignore

@@ -0,0 +1,7 @@
+test
+examples
+doc
+benchmark
+.travis.yml
+CHANGELOG.md
+UPGRADING.md

server/node_modules/cors-anywhere/node_modules/http-proxy/LICENSE

@@ -0,0 +1,23 @@
+
+  node-http-proxy
+
+  Copyright (c) Nodejitsu 2013
+
+  Permission is hereby granted, free of charge, to any person obtaining
+  a copy of this software and associated documentation files (the
+  "Software"), to deal in the Software without restriction, including
+  without limitation the rights to use, copy, modify, merge, publish,
+  distribute, sublicense, and/or sell copies of the Software, and to
+  permit persons to whom the Software is furnished to do so, subject to
+  the following conditions:
+
+  The above copyright notice and this permission notice shall be
+  included in all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+  LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+  WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

server/node_modules/cors-anywhere/node_modules/http-proxy/README.md

@@ -0,0 +1,400 @@
+<p align="center">
+  <img src="https://raw.github.com/nodejitsu/node-http-proxy/master/doc/logo.png"/>
+</p>
+
+node-http-proxy
+=======
+
+`node-http-proxy` is an HTTP programmable proxying library that supports
+websockets. It is suitable for implementing components such as
+proxies and load balancers.
+
+### Build Status
+
+<p align="center">
+ <a href="https://travis-ci.org/nodejitsu/node-http-proxy" target="_blank">
+ 	<img src="https://travis-ci.org/nodejitsu/node-http-proxy.png"/></a>&nbsp;&nbsp;
+ <a href="https://coveralls.io/r/nodejitsu/node-http-proxy" target="_blank">
+ 	<img src="https://coveralls.io/repos/nodejitsu/node-http-proxy/badge.png"/></a>
+</p>
+
+### Looking to Upgrade from 0.8.x ? Click [here](UPGRADING.md)
+
+### Core Concept
+
+A new proxy is created by calling `createProxyServer` and passing
+an `options` object as argument ([valid properties are available here](lib/http-proxy.js#L33-L50))
+
+```javascript
+var httpProxy = require('http-proxy');
+
+var proxy = httpProxy.createProxyServer(options);
+```
+
+An object will be returned with four values:
+
+* web `req, res, [options]` (used for proxying regular HTTP(S) requests)
+* ws `req, socket, head, [options]` (used for proxying WS(S) requests)
+* listen `port` (a function that wraps the object in a webserver, for your convenience)
+* close `[callback]` (a function that closes the inner webserver and stops listening on given port)
+
+It is then possible to proxy requests by calling these functions
+
+```javascript
+http.createServer(function(req, res) {
+  proxy.web(req, res, { target: 'http://mytarget.com:8080' });
+});
+```
+
+Errors can be listened on either using the Event Emitter API
+
+```javascript
+proxy.on('error', function(e) {
+  ...
+});
+```
+
+or using the callback API
+
+```javascript
+proxy.web(req, res, { target: 'http://mytarget.com:8080' }, function(e) { ... });
+```
+
+When a request is proxied it follows two different pipelines ([available here](lib/http-proxy/passes))
+which apply transformations to both the `req` and `res` object.
+The first pipeline (ingoing) is responsible for the creation and manipulation of the stream that connects your client to the target.
+The second pipeline (outgoing) is responsible for the creation and manipulation of the stream that, from your target, returns data
+to the client.
+
+
+#### Setup a basic stand-alone proxy server
+
+```js
+var http = require('http'),
+    httpProxy = require('http-proxy');
+//
+// Create your proxy server and set the target in the options.
+//
+httpProxy.createProxyServer({target:'http://localhost:9000'}).listen(8000);
+
+//
+// Create your target server
+//
+http.createServer(function (req, res) {
+  res.writeHead(200, { 'Content-Type': 'text/plain' });
+  res.write('request successfully proxied!' + '\n' + JSON.stringify(req.headers, true, 2));
+  res.end();
+}).listen(9000);
+```
+
+#### Setup a stand-alone proxy server with custom server logic
+This example show how you can proxy a request using your own HTTP server
+and also you can put your own logic to handle the request.
+
+```js
+var http = require('http'),
+    httpProxy = require('http-proxy');
+
+//
+// Create a proxy server with custom application logic
+//
+var proxy = httpProxy.createProxyServer({});
+
+//
+// Create your custom server and just call `proxy.web()` to proxy
+// a web request to the target passed in the options
+// also you can use `proxy.ws()` to proxy a websockets request
+//
+var server = http.createServer(function(req, res) {
+  // You can define here your custom logic to handle the request
+  // and then proxy the request.
+  proxy.web(req, res, { target: 'http://127.0.0.1:5060' });
+});
+
+console.log("listening on port 5050")
+server.listen(5050);
+```
+#### Modify a response from a proxied server
+Sometimes when you have received a HTML/XML document from the server of origin you would like to modify it before forwarding it on.
+
+[Harmon](https://github.com/No9/harmon) allows you to do this in a streaming style so as to keep the pressure on the proxy to a minimum.
+
+
+#### Setup a stand-alone proxy server with proxy request header re-writing
+This example shows how you can proxy a request using your own HTTP server that
+modifies the outgoing proxy request by adding a special header.
+
+```js
+var http = require('http'),
+    httpProxy = require('http-proxy');
+
+//
+// Create a proxy server with custom application logic
+//
+var proxy = httpProxy.createProxyServer({});
+
+// To modify the proxy connection before data is sent, you can listen
+// for the 'proxyReq' event. When the event is fired, you will receive
+// the following arguments:
+// (http.ClientRequest proxyReq, http.IncomingMessage req,
+//  http.ServerResponse res, Object options). This mechanism is useful when
+// you need to modify the proxy request before the proxy connection
+// is made to the target.
+//
+proxy.on('proxyReq', function(proxyReq, req, res, options) {
+  proxyReq.setHeader('X-Special-Proxy-Header', 'foobar');
+});
+
+var server = http.createServer(function(req, res) {
+  // You can define here your custom logic to handle the request
+  // and then proxy the request.
+  proxy.web(req, res, {
+    target: 'http://127.0.0.1:5060'
+  });
+});
+
+console.log("listening on port 5050")
+server.listen(5050);
+```
+
+#### Setup a stand-alone proxy server with latency
+
+```js
+var http = require('http'),
+    httpProxy = require('http-proxy');
+
+//
+// Create a proxy server with latency
+//
+var proxy = httpProxy.createProxyServer();
+
+//
+// Create your server that makes an operation that waits a while
+// and then proxies the request
+//
+http.createServer(function (req, res) {
+  // This simulates an operation that takes 500ms to execute
+  setTimeout(function () {
+    proxy.web(req, res, {
+      target: 'http://localhost:9008'
+    });
+  }, 500);
+}).listen(8008);
+
+//
+// Create your target server
+//
+http.createServer(function (req, res) {
+  res.writeHead(200, { 'Content-Type': 'text/plain' });
+  res.write('request successfully proxied to: ' + req.url + '\n' + JSON.stringify(req.headers, true, 2));
+  res.end();
+}).listen(9008);
+```
+
+#### Listening for proxy events
+
+* `error`: The error event is emitted if the request to the target fail.
+* `proxyRes`: This event is emitted if the request to the target got a response.
+* `open`: This event is emitted once the proxy websocket was created and piped into the target websocket.
+* `close`: This event is emitted once the proxy websocket was closed.
+* (DEPRECATED) `proxySocket`: Deprecated in favor of `open`.
+
+```js
+var httpProxy = require('http-proxy');
+// Error example
+//
+// Http Proxy Server with bad target
+//
+var proxy = httpProxy.createServer({
+  target:'http://localhost:9005'
+});
+
+proxy.listen(8005);
+
+//
+// Listen for the `error` event on `proxy`.
+proxy.on('error', function (err, req, res) {
+  res.writeHead(500, {
+    'Content-Type': 'text/plain'
+  });
+
+  res.end('Something went wrong. And we are reporting a custom error message.');
+});
+
+//
+// Listen for the `proxyRes` event on `proxy`.
+//
+proxy.on('proxyRes', function (proxyRes, req, res) {
+  console.log('RAW Response from the target', JSON.stringify(proxyRes.headers, true, 2));
+});
+
+//
+// Listen for the `open` event on `proxy`.
+//
+proxy.on('open', function (proxySocket) {
+  // listen for messages coming FROM the target here
+  proxySocket.on('data', hybiParseAndLogMessage);
+});
+
+//
+// Listen for the `close` event on `proxy`.
+//
+proxy.on('close', function (req, socket, head) {
+  // view disconnected websocket connections
+  console.log('Client disconnected');
+});
+```
+
+#### Using HTTPS
+You can activate the validation of a secure SSL certificate to the target connection (avoid self signed certs), just set `secure: true` in the options.
+
+##### HTTPS -> HTTP
+
+```js
+//
+// Create the HTTPS proxy server in front of a HTTP server
+//
+httpProxy.createServer({
+  target: {
+    host: 'localhost',
+    port: 9009
+  },
+  ssl: {
+    key: fs.readFileSync('valid-ssl-key.pem', 'utf8'),
+    cert: fs.readFileSync('valid-ssl-cert.pem', 'utf8')
+  }
+}).listen(8009);
+```
+
+##### HTTPS -> HTTPS
+
+```js
+//
+// Create the proxy server listening on port 443
+//
+httpProxy.createServer({
+  ssl: {
+    key: fs.readFileSync('valid-ssl-key.pem', 'utf8'),
+    cert: fs.readFileSync('valid-ssl-cert.pem', 'utf8')
+  },
+  target: 'https://localhost:9010',
+  secure: true // Depends on your needs, could be false.
+}).listen(443);
+```
+
+#### Proxying WebSockets
+You can activate the websocket support for the proxy using `ws:true` in the options.
+
+```js
+//
+// Create a proxy server for websockets
+//
+httpProxy.createServer({
+  target: 'ws://localhost:9014',
+  ws: true
+}).listen(8014);
+```
+
+Also you can proxy the websocket requests just calling the `ws(req, socket, head)` method.
+
+```js
+//
+// Setup our server to proxy standard HTTP requests
+//
+var proxy = new httpProxy.createProxyServer({
+  target: {
+    host: 'localhost',
+    port: 9015
+  }
+});
+var proxyServer = http.createServer(function (req, res) {
+  proxy.web(req, res);
+});
+
+//
+// Listen to the `upgrade` event and proxy the
+// WebSocket requests as well.
+//
+proxyServer.on('upgrade', function (req, socket, head) {
+  proxy.ws(req, socket, head);
+});
+
+proxyServer.listen(8015);
+```
+
+### Contributing and Issues
+
+* Search on Google/Github
+* If you can't find anything, open an issue
+* If you feel comfortable about fixing the issue, fork the repo
+* Commit to your local branch (which must be different from `master`)
+* Submit your Pull Request (be sure to include tests and update documentation)
+
+### Options
+
+`httpProxy.createProxyServer` supports the following options:
+
+ *  **target**: url string to be parsed with the url module
+ *  **forward**: url string to be parsed with the url module
+ *  **agent**: object to be passed to http(s).request (see Node's [https agent](http://nodejs.org/api/https.html#https_class_https_agent) and [http agent](http://nodejs.org/api/http.html#http_class_http_agent) objects)
+ *  **secure**: true/false, if you want to verify the SSL Certs
+ *  **xfwd**: true/false, adds x-forward headers
+ *  **toProxy**: passes the absolute URL as the `path` (useful for proxying to proxies)
+ *  **hostRewrite**: rewrites the location hostname on (301/302/307/308) redirects.
+
+If you are using the `proxyServer.listen` method, the following options are also applicable:
+
+ *  **ssl**: object to be passed to https.createServer()
+ *  **ws**: true/false, if you want to proxy websockets
+
+### Shutdown
+
+* When testing or running server within another program it may be necessary to close the proxy.
+* This will stop the proxy from accepting new connections.
+
+```js
+var proxy = new httpProxy.createProxyServer({
+  target: {
+    host: 'localhost',
+    port: 1337
+  }
+});
+
+proxy.close();
+```
+
+### Test
+
+```
+$ npm test
+```
+
+### Logo
+
+Logo created by [Diego Pasquali](http://dribbble.com/diegopq)
+
+### License
+
+>The MIT License (MIT)
+>
+>Copyright (c) 2010 - 2013 Nodejitsu Inc.
+>
+>Permission is hereby granted, free of charge, to any person obtaining a copy
+>of this software and associated documentation files (the "Software"), to deal
+>in the Software without restriction, including without limitation the rights
+>to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+>copies of the Software, and to permit persons to whom the Software is
+>furnished to do so, subject to the following conditions:
+>
+>The above copyright notice and this permission notice shall be included in
+>all copies or substantial portions of the Software.
+>
+>THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+>IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+>FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+>AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+>LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+>OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+>THE SOFTWARE.
+
+

server/node_modules/cors-anywhere/node_modules/http-proxy/index.js

@@ -0,0 +1,13 @@
+/*!
+ * Caron dimonio, con occhi di bragia
+ * loro accennando, tutte le raccoglie;
+ * batte col remo qualunque s’adagia 
+ *
+ * Charon the demon, with the eyes of glede,
+ * Beckoning to them, collects them all together,
+ * Beats with his oar whoever lags behind
+ *          
+ *          Dante - The Divine Comedy (Canto III)
+ */
+
+module.exports = require('./lib/http-proxy');

server/node_modules/cors-anywhere/node_modules/http-proxy/lib/http-proxy.js

@@ -0,0 +1,59 @@
+var http      = require('http'),
+    https     = require('https'),
+    url       = require('url'),
+    httpProxy = require('./http-proxy/');
+
+/**
+ * Export the proxy "Server" as the main export.
+ */
+module.exports = httpProxy.Server;
+
+/**
+ * Creates the proxy server.
+ *
+ * Examples:
+ *
+ *    httpProxy.createProxyServer({ .. }, 8000)
+ *    // => '{ web: [Function], ws: [Function] ... }'
+ *
+ * @param {Object} Options Config object passed to the proxy
+ *
+ * @return {Object} Proxy Proxy object with handlers for `ws` and `web` requests
+ *
+ * @api public
+ */
+
+module.exports.createProxyServer =
+  module.exports.createServer =
+  module.exports.createProxy = function createProxyServer(options) {
+  /*
+   *  `options` is needed and it must have the following layout:
+   *
+   *  {
+   *    target : <url string to be parsed with the url module>
+   *    forward: <url string to be parsed with the url module>
+   *    agent  : <object to be passed to http(s).request>
+   *    ssl    : <object to be passed to https.createServer()>
+   *    ws     : <true/false, if you want to proxy websockets>
+   *    xfwd   : <true/false, adds x-forward headers>
+   *    secure : <true/false, verify SSL certificate>
+   *    toProxy: <true/false, explicitly specify if we are proxying to another proxy>
+   *    prependPath: <true/false, Default: true - specify whether you want to prepend the target's path to the proxy path>
+   *    ignorePath: <true/false, Default: false - specify whether you want to ignore the proxy path of the incoming request>
+   *    localAddress : <Local interface string to bind for outgoing connections>
+   *    changeOrigin: <true/false, Default: false - changes the origin of the host header to the target URL>
+   *    auth   : Basic authentication i.e. 'user:password' to compute an Authorization header.  
+   *    hostRewrite: rewrites the location hostname on (301/302/307/308) redirects, Default: null.
+   *    autoRewrite: rewrites the location host/port on (301/302/307/308) redirects based on requested host/port. Default: false.
+   *    protocolRewrite: rewrites the location protocol on (301/302/307/308) redirects to 'http' or 'https'. Default: null.
+   *  }
+   *
+   *  NOTE: `options.ws` and `options.ssl` are optional.
+   *    `options.target and `options.forward` cannot be
+   *    both missing
+   *  }
+   */
+
+  return new httpProxy.Server(options);
+};
+

server/node_modules/cors-anywhere/node_modules/http-proxy/lib/http-proxy/common.js

@@ -0,0 +1,206 @@
+var common   = exports,
+    url      = require('url'),
+    extend   = require('util')._extend,
+    required = require('requires-port');
+
+var upgradeHeader = /(^|,)\s*upgrade\s*($|,)/i,
+    isSSL = /^https|wss/;
+
+/**
+ * Simple Regex for testing if protocol is https
+ */
+common.isSSL = isSSL;
+/**
+ * Copies the right headers from `options` and `req` to
+ * `outgoing` which is then used to fire the proxied
+ * request.
+ *
+ * Examples:
+ *
+ *    common.setupOutgoing(outgoing, options, req)
+ *    // => { host: ..., hostname: ...}
+ *
+ * @param {Object} Outgoing Base object to be filled with required properties
+ * @param {Object} Options Config object passed to the proxy
+ * @param {ClientRequest} Req Request Object
+ * @param {String} Forward String to select forward or target
+ * 
+ * @return {Object} Outgoing Object with all required properties set
+ *
+ * @api private
+ */
+
+common.setupOutgoing = function(outgoing, options, req, forward) {
+  outgoing.port = options[forward || 'target'].port ||
+                  (isSSL.test(options[forward || 'target'].protocol) ? 443 : 80);
+
+  ['host', 'hostname', 'socketPath', 'pfx', 'key',
+    'passphrase', 'cert', 'ca', 'ciphers', 'secureProtocol'].forEach(
+    function(e) { outgoing[e] = options[forward || 'target'][e]; }
+  );
+
+  outgoing.method = req.method;
+  outgoing.headers = extend({}, req.headers);
+
+  if (options.headers){
+    extend(outgoing.headers, options.headers);
+  }
+
+  if (options.auth) {
+    outgoing.auth = options.auth;
+  }
+
+  if (isSSL.test(options[forward || 'target'].protocol)) {
+    outgoing.rejectUnauthorized = (typeof options.secure === "undefined") ? true : options.secure;
+  }
+
+
+  outgoing.agent = options.agent || false;
+  outgoing.localAddress = options.localAddress;
+
+  //
+  // Remark: If we are false and not upgrading, set the connection: close. This is the right thing to do
+  // as node core doesn't handle this COMPLETELY properly yet.
+  //
+  if (!outgoing.agent) {
+    outgoing.headers = outgoing.headers || {};
+    if (typeof outgoing.headers.connection !== 'string'
+        || !upgradeHeader.test(outgoing.headers.connection)
+       ) { outgoing.headers.connection = 'close'; }
+  }
+
+
+  // the final path is target path + relative path requested by user:
+  var target = options[forward || 'target'];
+  var targetPath = target && options.prependPath !== false
+    ? (target.path || '')
+    : '';
+
+  //
+  // Remark: Can we somehow not use url.parse as a perf optimization?
+  //
+  var outgoingPath = !options.toProxy
+    ? (url.parse(req.url).path || '/')
+    : req.url;
+
+  //
+  // Remark: ignorePath will just straight up ignore whatever the request's
+  // path is. This can be labeled as FOOT-GUN material if you do not know what
+  // you are doing and are using conflicting options.
+  //
+  outgoingPath = !options.ignorePath ? outgoingPath : '/';
+
+  outgoing.path = common.urlJoin(targetPath, outgoingPath);
+
+  if (options.changeOrigin) {
+    outgoing.headers.host =
+      required(outgoing.port, options[forward || 'target'].protocol) && !hasPort(outgoing.host)
+        ? outgoing.host + ':' + outgoing.port
+        : outgoing.host;
+  }
+  return outgoing;
+};
+
+/**
+ * Set the proper configuration for sockets,
+ * set no delay and set keep alive, also set
+ * the timeout to 0.
+ *
+ * Examples:
+ *
+ *    common.setupSocket(socket)
+ *    // => Socket
+ *
+ * @param {Socket} Socket instance to setup
+ * 
+ * @return {Socket} Return the configured socket.
+ *
+ * @api private
+ */
+
+common.setupSocket = function(socket) {
+  socket.setTimeout(0);
+  socket.setNoDelay(true);
+
+  socket.setKeepAlive(true, 0);
+
+  return socket;
+};
+
+/**
+ * Get the port number from the host. Or guess it based on the connection type.
+ *
+ * @param {Request} req Incoming HTTP request.
+ *
+ * @return {String} The port number.
+ *
+ * @api private
+ */
+common.getPort = function(req) {
+  var res = req.headers.host ? req.headers.host.match(/:(\d+)/) : '';
+
+  return res ?
+    res[1] :
+    common.hasEncryptedConnection(req) ? '443' : '80';
+};
+
+/**
+ * Check if the request has an encrypted connection.
+ *
+ * @param {Request} req Incoming HTTP request.
+ *
+ * @return {Boolean} Whether the connection is encrypted or not.
+ *
+ * @api private
+ */
+common.hasEncryptedConnection = function(req) {
+  return Boolean(req.connection.encrypted || req.connection.pair);
+};
+
+/**
+ * OS-agnostic join (doesn't break on URLs like path.join does on Windows)>
+ *
+ * @return {String} The generated path.
+ *
+ * @api private
+ */
+
+common.urlJoin = function() {
+    //
+    // We do not want to mess with the query string. All we want to touch is the path.
+    //
+  var args = Array.prototype.slice.call(arguments),
+      lastIndex = args.length - 1,
+      last = args[lastIndex],
+      lastSegs = last.split('?'),
+      retSegs;
+
+  args[lastIndex] = lastSegs.shift();
+
+  //
+  // Join all strings, but remove empty strings so we don't get extra slashes from
+  // joining e.g. ['', 'am']
+  //
+  retSegs = [
+    args.filter(Boolean).join('/').replace(/\/+/g, '/').replace(/:\//g, '://')
+  ];
+
+  // Only join the query string if it exists so we don't have trailing a '?'
+  // on every request
+
+  // Handle case where there could be multiple ? in the URL.
+  retSegs.push.apply(retSegs, lastSegs);
+
+  return retSegs.join('?')
+};
+
+/**
+ * Check the host and see if it potentially has a port in it (keep it simple)
+ *
+ * @returns {Boolean} Whether we have one or not
+ *
+ * @api private
+ */
+function hasPort(host) {
+  return !!~host.indexOf(':');
+};

server/node_modules/cors-anywhere/node_modules/http-proxy/lib/http-proxy/index.js

@@ -0,0 +1,184 @@
+var httpProxy = exports,
+    extend    = require('util')._extend,
+    parse_url = require('url').parse,
+    EE3       = require('eventemitter3'),
+    http      = require('http'),
+    https     = require('https'),
+    web       = require('./passes/web-incoming'),
+    ws        = require('./passes/ws-incoming');
+
+httpProxy.Server = ProxyServer;
+
+/**
+ * Returns a function that creates the loader for
+ * either `ws` or `web`'s  passes.
+ *
+ * Examples:
+ *
+ *    httpProxy.createRightProxy('ws')
+ *    // => [Function]
+ *
+ * @param {String} Type Either 'ws' or 'web'
+ * 
+ * @return {Function} Loader Function that when called returns an iterator for the right passes
+ *
+ * @api private
+ */
+
+function createRightProxy(type) {
+
+  return function(options) {
+    return function(req, res /*, [head], [opts] */) {
+      var passes = (type === 'ws') ? this.wsPasses : this.webPasses,
+          args = [].slice.call(arguments),
+          cntr = args.length - 1,
+          head, cbl;
+
+      /* optional args parse begin */
+      if(typeof args[cntr] === 'function') {
+        cbl = args[cntr];
+
+        cntr--;
+      }
+
+      if(
+        !(args[cntr] instanceof Buffer) &&
+        args[cntr] !== res
+      ) {
+        //Copy global options
+        options = extend({}, options);
+        //Overwrite with request options
+        extend(options, args[cntr]);
+
+        cntr--;
+      }
+
+      if(args[cntr] instanceof Buffer) {
+        head = args[cntr];
+      }
+
+      /* optional args parse end */
+
+      ['target', 'forward'].forEach(function(e) {
+        if (typeof options[e] === 'string')
+          options[e] = parse_url(options[e]);
+      });
+
+      if (!options.target && !options.forward) {
+        return this.emit('error', new Error('Must provide a proper URL as target'));
+      }
+
+      for(var i=0; i < passes.length; i++) {
+        /**
+         * Call of passes functions
+         * pass(req, res, options, head)
+         *
+         * In WebSockets case the `res` variable
+         * refer to the connection socket
+         * pass(req, socket, options, head)
+         */
+        if(passes[i](req, res, options, head, this, cbl)) { // passes can return a truthy value to halt the loop
+          break;
+        }
+      }
+    };
+  };
+}
+httpProxy.createRightProxy = createRightProxy;
+
+function ProxyServer(options) {
+  EE3.call(this);
+
+  options = options || {};
+  options.prependPath = options.prependPath === false ? false : true;
+
+  this.web = this.proxyRequest           = createRightProxy('web')(options);
+  this.ws  = this.proxyWebsocketRequest  = createRightProxy('ws')(options);
+  this.options = options;
+
+  this.webPasses = Object.keys(web).map(function(pass) {
+    return web[pass];
+  });
+
+  this.wsPasses = Object.keys(ws).map(function(pass) {
+    return ws[pass];
+  });
+
+  this.on('error', this.onError, this);
+
+}
+
+require('util').inherits(ProxyServer, EE3);
+
+ProxyServer.prototype.onError = function (err) {
+  //
+  // Remark: Replicate node core behavior using EE3
+  // so we force people to handle their own errors
+  //
+  if(this.listeners('error').length === 1) {
+    throw err;
+  }
+};
+
+ProxyServer.prototype.listen = function(port, hostname) {
+  var self    = this,
+      closure = function(req, res) { self.web(req, res); };
+
+  this._server  = this.options.ssl ?
+    https.createServer(this.options.ssl, closure) :
+    http.createServer(closure);
+
+  if(this.options.ws) {
+    this._server.on('upgrade', function(req, socket, head) { self.ws(req, socket, head); });
+  }
+
+  this._server.listen(port, hostname);
+
+  return this;
+};
+
+ProxyServer.prototype.close = function(callback) {
+  var self = this;
+  if (this._server) {
+    this._server.close(done);
+  }
+
+  // Wrap callback to nullify server after all open connections are closed.
+  function done() {
+    self._server = null;
+    if (callback) {
+      callback.apply(null, arguments);
+    }
+  };
+};
+
+ProxyServer.prototype.before = function(type, passName, callback) {
+  if (type !== 'ws' && type !== 'web') {
+    throw new Error('type must be `web` or `ws`');
+  }
+  var passes = (type === 'ws') ? this.wsPasses : this.webPasses,
+      i = false;
+
+  passes.forEach(function(v, idx) {
+    if(v.name === passName) i = idx;
+  })
+
+  if(i === false) throw new Error('No such pass');
+
+  passes.splice(i, 0, callback);
+};
+ProxyServer.prototype.after = function(type, passName, callback) {
+  if (type !== 'ws' && type !== 'web') {
+    throw new Error('type must be `web` or `ws`');
+  }
+  var passes = (type === 'ws') ? this.wsPasses : this.webPasses,
+      i = false;
+
+  passes.forEach(function(v, idx) {
+    if(v.name === passName) i = idx;
+  })
+
+  if(i === false) throw new Error('No such pass');
+
+  passes.splice(i++, 0, callback);
+};

server/node_modules/cors-anywhere/node_modules/http-proxy/lib/http-proxy/passes/web-incoming.js

@@ -0,0 +1,166 @@
+var http   = require('http'),
+    https  = require('https'),
+    web_o  = require('./web-outgoing'),
+    common = require('../common'),
+    passes = exports;
+
+web_o = Object.keys(web_o).map(function(pass) {
+  return web_o[pass];
+});
+
+/*!
+ * Array of passes.
+ *
+ * A `pass` is just a function that is executed on `req, res, options`
+ * so that you can easily add new checks while still keeping the base
+ * flexible.
+ */
+
+[ // <--
+
+  /**
+   * Sets `content-length` to '0' if request is of DELETE type.
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {IncomingMessage} Res Response object
+   * @param {Object} Options Config object passed to the proxy
+   *
+   * @api private
+   */
+
+  function deleteLength(req, res, options) {
+    if((req.method === 'DELETE' || req.method === 'OPTIONS')
+       && !req.headers['content-length']) {
+      req.headers['content-length'] = '0';
+    }
+  },
+
+  /**
+   * Sets timeout in request socket if it was specified in options.
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {IncomingMessage} Res Response object
+   * @param {Object} Options Config object passed to the proxy
+   *
+   * @api private
+   */
+
+  function timeout(req, res, options) {
+    if(options.timeout) {
+      req.socket.setTimeout(options.timeout);
+    }
+  },
+
+  /**
+   * Sets `x-forwarded-*` headers if specified in config.
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {IncomingMessage} Res Response object
+   * @param {Object} Options Config object passed to the proxy
+   *
+   * @api private
+   */
+
+  function XHeaders(req, res, options) {
+    if(!options.xfwd) return;
+
+    var encrypted = req.isSpdy || common.hasEncryptedConnection(req);
+    var values = {
+      for  : req.connection.remoteAddress || req.socket.remoteAddress,
+      port : common.getPort(req),
+      proto: encrypted ? 'https' : 'http'
+    };
+
+    ['for', 'port', 'proto'].forEach(function(header) {
+      req.headers['x-forwarded-' + header] =
+        (req.headers['x-forwarded-' + header] || '') +
+        (req.headers['x-forwarded-' + header] ? ',' : '') +
+        values[header];
+    });
+  },
+
+  /**
+   * Does the actual proxying. If `forward` is enabled fires up
+   * a ForwardStream, same happens for ProxyStream. The request
+   * just dies otherwise.
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {IncomingMessage} Res Response object
+   * @param {Object} Options Config object passed to the proxy
+   *
+   * @api private
+   */
+
+  function stream(req, res, options, _, server, clb) {
+
+    // And we begin!
+    server.emit('start', req, res, options.target)
+    if(options.forward) {
+      // If forward enable, so just pipe the request
+      var forwardReq = (options.forward.protocol === 'https:' ? https : http).request(
+        common.setupOutgoing(options.ssl || {}, options, req, 'forward')
+      );
+      (options.buffer || req).pipe(forwardReq);
+      if(!options.target) { return res.end(); }
+    }
+
+    // Request initalization
+    var proxyReq = (options.target.protocol === 'https:' ? https : http).request(
+      common.setupOutgoing(options.ssl || {}, options, req)
+    );
+
+    // Enable developers to modify the proxyReq before headers are sent
+    proxyReq.on('socket', function(socket) {
+      if(server) { server.emit('proxyReq', proxyReq, req, res, options); }
+    });
+
+    // allow outgoing socket to timeout so that we could
+    // show an error page at the initial request
+    if(options.proxyTimeout) {
+      proxyReq.setTimeout(options.proxyTimeout, function() {
+         proxyReq.abort();
+      });
+    }
+
+    // Ensure we abort proxy if request is aborted
+    req.on('aborted', function () {
+      proxyReq.abort();
+    });
+
+    // Handle errors on incoming request as well as it makes sense to
+    req.on('error', proxyError);
+
+    // Error Handler
+    proxyReq.on('error', proxyError);
+
+    function proxyError (err){
+      if (clb) {
+        clb(err, req, res, options.target);
+      } else {
+        server.emit('error', err, req, res, options.target);
+      }
+    }
+
+    (options.buffer || req).pipe(proxyReq);
+
+    proxyReq.on('response', function(proxyRes) {
+      if(server) { server.emit('proxyRes', proxyRes, req, res); }
+      for(var i=0; i < web_o.length; i++) {
+        if(web_o[i](req, res, proxyRes, options)) { break; }
+      }
+
+      // Allow us to listen when the proxy has completed
+      proxyRes.on('end', function () {
+        server.emit('end', req, res, proxyRes);
+      });
+
+      proxyRes.pipe(res);
+    });
+
+    //proxyReq.end();
+  }
+
+] // <--
+  .forEach(function(func) {
+    passes[func.name] = func;
+  });

server/node_modules/cors-anywhere/node_modules/http-proxy/lib/http-proxy/passes/web-outgoing.js

@@ -0,0 +1,105 @@
+var url    = require('url'),
+    passes = exports;
+
+var redirectRegex = /^30(1|2|7|8)$/;
+
+/*!
+ * Array of passes.
+ *
+ * A `pass` is just a function that is executed on `req, res, options`
+ * so that you can easily add new checks while still keeping the base
+ * flexible.
+ */
+
+[ // <--
+
+  /**
+   * If is a HTTP 1.0 request, remove chunk headers
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {IncomingMessage} Res Response object
+   * @param {proxyResponse} Res Response object from the proxy request
+   *
+   * @api private
+   */
+  function removeChunked(req, res, proxyRes) {
+    if (req.httpVersion === '1.0') {
+      delete proxyRes.headers['transfer-encoding'];
+    }
+  },
+
+  /**
+   * If is a HTTP 1.0 request, set the correct connection header
+   * or if connection header not present, then use `keep-alive`
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {IncomingMessage} Res Response object
+   * @param {proxyResponse} Res Response object from the proxy request
+   *
+   * @api private
+   */
+  function setConnection(req, res, proxyRes) {
+    if (req.httpVersion === '1.0') {
+      proxyRes.headers.connection = req.headers.connection || 'close';
+    } else if (!proxyRes.headers.connection) {
+      proxyRes.headers.connection = req.headers.connection || 'keep-alive';
+    }
+  },
+
+  function setRedirectHostRewrite(req, res, proxyRes, options) {
+    if ((options.hostRewrite || options.autoRewrite || options.protocolRewrite)
+        && proxyRes.headers['location']
+        && redirectRegex.test(proxyRes.statusCode)) {
+      var target = url.parse(options.target);
+      var u = url.parse(proxyRes.headers['location']);
+
+      // make sure the redirected host matches the target host before rewriting
+      if (target.host != u.host) {
+        return;
+      }
+
+      if (options.hostRewrite) {
+        u.host = options.hostRewrite;
+      } else if (options.autoRewrite) {
+        u.host = req.headers['host'];
+      }
+      if (options.protocolRewrite) {
+        u.protocol = options.protocolRewrite;
+      }
+
+      proxyRes.headers['location'] = u.format();
+    }
+  },
+  /**
+   * Copy headers from proxyResponse to response
+   * set each header in response object.
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {IncomingMessage} Res Response object
+   * @param {proxyResponse} Res Response object from the proxy request
+   *
+   * @api private
+   */
+  function writeHeaders(req, res, proxyRes) {
+    Object.keys(proxyRes.headers).forEach(function(key) {
+      res.setHeader(key, proxyRes.headers[key]);
+    });
+  },
+
+  /**
+   * Set the statusCode from the proxyResponse
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {IncomingMessage} Res Response object
+   * @param {proxyResponse} Res Response object from the proxy request
+   *
+   * @api private
+   */
+  function writeStatusCode(req, res, proxyRes) {
+    res.writeHead(proxyRes.statusCode);
+  }
+
+] // <--
+  .forEach(function(func) {
+    passes[func.name] = func;
+  });

server/node_modules/cors-anywhere/node_modules/http-proxy/lib/http-proxy/passes/ws-incoming.js

@@ -0,0 +1,141 @@
+var http   = require('http'),
+    https  = require('https'),
+    common = require('../common'),
+    passes = exports;
+
+/*!
+ * Array of passes.
+ *
+ * A `pass` is just a function that is executed on `req, socket, options`
+ * so that you can easily add new checks while still keeping the base
+ * flexible.
+ */
+
+/*
+ * Websockets Passes
+ *
+ */
+
+var passes = exports;
+
+[
+  /**
+   * WebSocket requests must have the `GET` method and
+   * the `upgrade:websocket` header
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {Socket} Websocket
+   *
+   * @api private
+   */
+
+  function checkMethodAndHeader (req, socket) {
+    if (req.method !== 'GET' || !req.headers.upgrade) {
+      socket.destroy();
+      return true;
+    }
+
+    if (req.headers.upgrade.toLowerCase() !== 'websocket') {
+      socket.destroy();
+      return true;
+    }
+  },
+
+  /**
+   * Sets `x-forwarded-*` headers if specified in config.
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {Socket} Websocket
+   * @param {Object} Options Config object passed to the proxy
+   *
+   * @api private
+   */
+
+  function XHeaders(req, socket, options) {
+    if(!options.xfwd) return;
+
+    var values = {
+      for  : req.connection.remoteAddress || req.socket.remoteAddress,
+      port : common.getPort(req),
+      proto: common.hasEncryptedConnection(req) ? 'wss' : 'ws'
+    };
+
+    ['for', 'port', 'proto'].forEach(function(header) {
+      req.headers['x-forwarded-' + header] =
+        (req.headers['x-forwarded-' + header] || '') +
+        (req.headers['x-forwarded-' + header] ? ',' : '') +
+        values[header];
+    });
+  },
+
+  /**
+   * Does the actual proxying. Make the request and upgrade it
+   * send the Switching Protocols request and pipe the sockets.
+   *
+   * @param {ClientRequest} Req Request object
+   * @param {Socket} Websocket
+   * @param {Object} Options Config object passed to the proxy
+   *
+   * @api private
+   */
+  function stream(req, socket, options, head, server, clb) {
+    common.setupSocket(socket);
+
+    if (head && head.length) socket.unshift(head);
+
+
+    var proxyReq = (common.isSSL.test(options.target.protocol) ? https : http).request(
+      common.setupOutgoing(options.ssl || {}, options, req)
+    );
+    // Error Handler
+    proxyReq.on('error', onOutgoingError);
+    proxyReq.on('response', function (res) {
+      // if upgrade event isn't going to happen, close the socket
+      if (!res.upgrade) socket.end();
+    });
+
+    proxyReq.on('upgrade', function(proxyRes, proxySocket, proxyHead) {
+      proxySocket.on('error', onOutgoingError);
+
+      // Allow us to listen when the websocket has completed
+      proxySocket.on('end', function () {
+        server.emit('close', proxyRes, proxySocket, proxyHead);
+      });
+
+      // The pipe below will end proxySocket if socket closes cleanly, but not
+      // if it errors (eg, vanishes from the net and starts returning
+      // EHOSTUNREACH). We need to do that explicitly.
+      socket.on('error', function () {
+        proxySocket.end();
+      });
+
+      common.setupSocket(proxySocket);
+
+      if (proxyHead && proxyHead.length) proxySocket.unshift(proxyHead);
+
+      socket.write('HTTP/1.1 101 Switching Protocols\r\n');
+      socket.write(Object.keys(proxyRes.headers).map(function(i) {
+        return i + ": " + proxyRes.headers[i];
+      }).join('\r\n') + '\r\n\r\n');
+      proxySocket.pipe(socket).pipe(proxySocket);
+
+      server.emit('open', proxySocket);
+      server.emit('proxySocket', proxySocket);  //DEPRECATED.
+    });
+
+    return proxyReq.end(); // XXX: CHECK IF THIS IS THIS CORRECT
+
+    function onOutgoingError(err) {
+      if (clb) {
+        clb(err, req, socket);
+      } else {
+        server.emit('error', err, req, socket);
+      }
+      socket.end();
+    }
+  }
+
+] // <--
+  .forEach(function(func) {
+    passes[func.name] = func;
+  });

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/eventemitter3/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Arnout Kazemier
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/eventemitter3/README.md

@@ -0,0 +1,89 @@
+# EventEmitter3
+
+[![Version npm](https://img.shields.io/npm/v/eventemitter3.svg?style=flat-square)](http://browsenpm.org/package/eventemitter3)[![Build Status](https://img.shields.io/travis/primus/eventemitter3/master.svg?style=flat-square)](https://travis-ci.org/primus/eventemitter3)[![Dependencies](https://img.shields.io/david/primus/eventemitter3.svg?style=flat-square)](https://david-dm.org/primus/eventemitter3)[![Coverage Status](https://img.shields.io/coveralls/primus/eventemitter3/master.svg?style=flat-square)](https://coveralls.io/r/primus/eventemitter3?branch=master)[![IRC channel](https://img.shields.io/badge/IRC-irc.freenode.net%23primus-00a8ff.svg?style=flat-square)](https://webchat.freenode.net/?channels=primus)
+
+[![Sauce Test Status](https://saucelabs.com/browser-matrix/eventemitter3.svg)](https://saucelabs.com/u/eventemitter3)
+
+EventEmitter3 is a high performance EventEmitter. It has been micro-optimized
+for various of code paths making this, one of, if not the fastest EventEmitter
+available for Node.js and browsers. The module is API compatible with the
+EventEmitter that ships by default with Node.js but there are some slight
+differences:
+
+- Domain support has been removed.
+- We do not `throw` an error when you emit an `error` event and nobody is
+  listening.
+- The `newListener` event is removed as the use-cases for this functionality are
+  really just edge cases.
+- No `setMaxListeners` and it's pointless memory leak warnings. If you want to
+  add `end` listeners you should be able to do that without modules complaining.
+- No `listenerCount` function. Use `EE.listeners(event).length` instead.
+- Support for custom context for events so there is no need to use `fn.bind`.
+- `listeners` method can do existence checking instead of returning only arrays.
+
+It's a drop in replacement for existing EventEmitters, but just faster. Free
+performance, who wouldn't want that? The EventEmitter is written in EcmaScript 3
+so it will work in the oldest browsers and node versions that you need to
+support.
+
+## Installation
+
+```bash
+$ npm install --save eventemitter3        # npm
+$ component install primus/eventemitter3  # Component
+$ bower install eventemitter3             # Bower
+```
+
+## Usage
+
+After installation the only thing you need to do is require the module:
+
+```js
+var EventEmitter = require('eventemitter3');
+```
+
+And you're ready to create your own EventEmitter instances. For the API
+documentation, please follow the official Node.js documentation:
+
+http://nodejs.org/api/events.html
+
+### Contextual emits
+
+We've upgraded the API of the `EventEmitter.on`, `EventEmitter.once` and
+`EventEmitter.removeListener` to accept an extra argument which is the `context`
+or `this` value that should be set for the emitted events. This means you no
+longer have the overhead of an event that required `fn.bind` in order to get a
+custom `this` value.
+
+```js
+var EE = new EventEmitter()
+  , context = { foo: 'bar' };
+
+function emitted() {
+  console.log(this === context); // true
+}
+
+EE.once('event-name', emitted, context);
+EE.on('another-event', emitted, context);
+EE.removeListener('another-event', emitted, context);
+```
+
+### Existence
+
+To check if there is already a listener for a given event you can supply the
+`listeners` method with an extra boolean argument. This will transform the
+output from an array, to a boolean value which indicates if there are listeners
+in place for the given event:
+
+```js
+var EE = new EventEmitter();
+EE.once('event-name', function () {});
+EE.on('another-event', function () {});
+
+EE.listeners('event-name', true); // returns true
+EE.listeners('unknown-name', true); // returns false
+```
+
+## License
+
+[MIT](LICENSE)

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/eventemitter3/index.js

@@ -0,0 +1,262 @@
+'use strict';
+
+//
+// We store our EE objects in a plain object whose properties are event names.
+// If `Object.create(null)` is not supported we prefix the event names with a
+// `~` to make sure that the built-in object properties are not overridden or
+// used as an attack vector.
+// We also assume that `Object.create(null)` is available when the event name
+// is an ES6 Symbol.
+//
+var prefix = typeof Object.create !== 'function' ? '~' : false;
+
+/**
+ * Representation of a single EventEmitter function.
+ *
+ * @param {Function} fn Event handler to be called.
+ * @param {Mixed} context Context for function execution.
+ * @param {Boolean} once Only emit once
+ * @api private
+ */
+function EE(fn, context, once) {
+  this.fn = fn;
+  this.context = context;
+  this.once = once || false;
+}
+
+/**
+ * Minimal EventEmitter interface that is molded against the Node.js
+ * EventEmitter interface.
+ *
+ * @constructor
+ * @api public
+ */
+function EventEmitter() { /* Nothing to set */ }
+
+/**
+ * Holds the assigned EventEmitters by name.
+ *
+ * @type {Object}
+ * @private
+ */
+EventEmitter.prototype._events = undefined;
+
+/**
+ * Return a list of assigned event listeners.
+ *
+ * @param {String} event The events that should be listed.
+ * @param {Boolean} exists We only need to know if there are listeners.
+ * @returns {Array|Boolean}
+ * @api public
+ */
+EventEmitter.prototype.listeners = function listeners(event, exists) {
+  var evt = prefix ? prefix + event : event
+    , available = this._events && this._events[evt];
+
+  if (exists) return !!available;
+  if (!available) return [];
+  if (available.fn) return [available.fn];
+
+  for (var i = 0, l = available.length, ee = new Array(l); i < l; i++) {
+    ee[i] = available[i].fn;
+  }
+
+  return ee;
+};
+
+/**
+ * Emit an event to all registered event listeners.
+ *
+ * @param {String} event The name of the event.
+ * @returns {Boolean} Indication if we've emitted an event.
+ * @api public
+ */
+EventEmitter.prototype.emit = function emit(event, a1, a2, a3, a4, a5) {
+  var evt = prefix ? prefix + event : event;
+
+  if (!this._events || !this._events[evt]) return false;
+
+  var listeners = this._events[evt]
+    , len = arguments.length
+    , args
+    , i;
+
+  if ('function' === typeof listeners.fn) {
+    if (listeners.once) this.removeListener(event, listeners.fn, undefined, true);
+
+    switch (len) {
+      case 1: return listeners.fn.call(listeners.context), true;
+      case 2: return listeners.fn.call(listeners.context, a1), true;
+      case 3: return listeners.fn.call(listeners.context, a1, a2), true;
+      case 4: return listeners.fn.call(listeners.context, a1, a2, a3), true;
+      case 5: return listeners.fn.call(listeners.context, a1, a2, a3, a4), true;
+      case 6: return listeners.fn.call(listeners.context, a1, a2, a3, a4, a5), true;
+    }
+
+    for (i = 1, args = new Array(len -1); i < len; i++) {
+      args[i - 1] = arguments[i];
+    }
+
+    listeners.fn.apply(listeners.context, args);
+  } else {
+    var length = listeners.length
+      , j;
+
+    for (i = 0; i < length; i++) {
+      if (listeners[i].once) this.removeListener(event, listeners[i].fn, undefined, true);
+
+      switch (len) {
+        case 1: listeners[i].fn.call(listeners[i].context); break;
+        case 2: listeners[i].fn.call(listeners[i].context, a1); break;
+        case 3: listeners[i].fn.call(listeners[i].context, a1, a2); break;
+        default:
+          if (!args) for (j = 1, args = new Array(len -1); j < len; j++) {
+            args[j - 1] = arguments[j];
+          }
+
+          listeners[i].fn.apply(listeners[i].context, args);
+      }
+    }
+  }
+
+  return true;
+};
+
+/**
+ * Register a new EventListener for the given event.
+ *
+ * @param {String} event Name of the event.
+ * @param {Functon} fn Callback function.
+ * @param {Mixed} context The context of the function.
+ * @api public
+ */
+EventEmitter.prototype.on = function on(event, fn, context) {
+  var listener = new EE(fn, context || this)
+    , evt = prefix ? prefix + event : event;
+
+  if (!this._events) this._events = prefix ? {} : Object.create(null);
+  if (!this._events[evt]) this._events[evt] = listener;
+  else {
+    if (!this._events[evt].fn) this._events[evt].push(listener);
+    else this._events[evt] = [
+      this._events[evt], listener
+    ];
+  }
+
+  return this;
+};
+
+/**
+ * Add an EventListener that's only called once.
+ *
+ * @param {String} event Name of the event.
+ * @param {Function} fn Callback function.
+ * @param {Mixed} context The context of the function.
+ * @api public
+ */
+EventEmitter.prototype.once = function once(event, fn, context) {
+  var listener = new EE(fn, context || this, true)
+    , evt = prefix ? prefix + event : event;
+
+  if (!this._events) this._events = prefix ? {} : Object.create(null);
+  if (!this._events[evt]) this._events[evt] = listener;
+  else {
+    if (!this._events[evt].fn) this._events[evt].push(listener);
+    else this._events[evt] = [
+      this._events[evt], listener
+    ];
+  }
+
+  return this;
+};
+
+/**
+ * Remove event listeners.
+ *
+ * @param {String} event The event we want to remove.
+ * @param {Function} fn The listener that we need to find.
+ * @param {Mixed} context Only remove listeners matching this context.
+ * @param {Boolean} once Only remove once listeners.
+ * @api public
+ */
+EventEmitter.prototype.removeListener = function removeListener(event, fn, context, once) {
+  var evt = prefix ? prefix + event : event;
+
+  if (!this._events || !this._events[evt]) return this;
+
+  var listeners = this._events[evt]
+    , events = [];
+
+  if (fn) {
+    if (listeners.fn) {
+      if (
+           listeners.fn !== fn
+        || (once && !listeners.once)
+        || (context && listeners.context !== context)
+      ) {
+        events.push(listeners);
+      }
+    } else {
+      for (var i = 0, length = listeners.length; i < length; i++) {
+        if (
+             listeners[i].fn !== fn
+          || (once && !listeners[i].once)
+          || (context && listeners[i].context !== context)
+        ) {
+          events.push(listeners[i]);
+        }
+      }
+    }
+  }
+
+  //
+  // Reset the array, or remove it completely if we have no more listeners.
+  //
+  if (events.length) {
+    this._events[evt] = events.length === 1 ? events[0] : events;
+  } else {
+    delete this._events[evt];
+  }
+
+  return this;
+};
+
+/**
+ * Remove all listeners or only the listeners for the specified event.
+ *
+ * @param {String} event The event want to remove all listeners for.
+ * @api public
+ */
+EventEmitter.prototype.removeAllListeners = function removeAllListeners(event) {
+  if (!this._events) return this;
+
+  if (event) delete this._events[prefix ? prefix + event : event];
+  else this._events = prefix ? {} : Object.create(null);
+
+  return this;
+};
+
+//
+// Alias methods names because people roll like that.
+//
+EventEmitter.prototype.off = EventEmitter.prototype.removeListener;
+EventEmitter.prototype.addListener = EventEmitter.prototype.on;
+
+//
+// This function doesn't apply anymore.
+//
+EventEmitter.prototype.setMaxListeners = function setMaxListeners() {
+  return this;
+};
+
+//
+// Expose the prefix.
+//
+EventEmitter.prefixed = prefix;
+
+//
+// Expose the module.
+//
+if ('undefined' !== typeof module) {
+  module.exports = EventEmitter;
+}

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/eventemitter3/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "eventemitter3",
+  "version": "1.1.1",
+  "description": "EventEmitter3 focuses on performance while maintaining a Node.js AND browser compatible interface.",
+  "main": "index.js",
+  "scripts": {
+    "test-browser": "zuul --browser-name ${BROWSER_NAME} --browser-version ${BROWSER_VERSION} -- test.js",
+    "test-node": "istanbul cover node_modules/.bin/_mocha --report lcovonly -- test.js",
+    "coverage": "istanbul cover ./node_modules/.bin/_mocha -- test.js",
+    "sync": "node versions.js",
+    "test": "mocha test.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/primus/eventemitter3.git"
+  },
+  "keywords": [
+    "EventEmitter",
+    "EventEmitter2",
+    "EventEmitter3",
+    "Events",
+    "addEventListener",
+    "addListener",
+    "emit",
+    "emits",
+    "emitter",
+    "event",
+    "once",
+    "pub/sub",
+    "publish",
+    "reactor",
+    "subscribe"
+  ],
+  "author": {
+    "name": "Arnout Kazemier"
+  },
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/primus/eventemitter3/issues"
+  },
+  "pre-commit": "sync, test",
+  "devDependencies": {
+    "assume": "1.2.x",
+    "istanbul": "0.3.x",
+    "mocha": "2.2.x",
+    "pre-commit": "1.0.x",
+    "zuul": "3.0.x"
+  },
+  "readme": "# EventEmitter3\n\n[![Version npm](https://img.shields.io/npm/v/eventemitter3.svg?style=flat-square)](http://browsenpm.org/package/eventemitter3)[![Build Status](https://img.shields.io/travis/primus/eventemitter3/master.svg?style=flat-square)](https://travis-ci.org/primus/eventemitter3)[![Dependencies](https://img.shields.io/david/primus/eventemitter3.svg?style=flat-square)](https://david-dm.org/primus/eventemitter3)[![Coverage Status](https://img.shields.io/coveralls/primus/eventemitter3/master.svg?style=flat-square)](https://coveralls.io/r/primus/eventemitter3?branch=master)[![IRC channel](https://img.shields.io/badge/IRC-irc.freenode.net%23primus-00a8ff.svg?style=flat-square)](https://webchat.freenode.net/?channels=primus)\n\n[![Sauce Test Status](https://saucelabs.com/browser-matrix/eventemitter3.svg)](https://saucelabs.com/u/eventemitter3)\n\nEventEmitter3 is a high performance EventEmitter. It has been micro-optimized\nfor various of code paths making this, one of, if not the fastest EventEmitter\navailable for Node.js and browsers. The module is API compatible with the\nEventEmitter that ships by default with Node.js but there are some slight\ndifferences:\n\n- Domain support has been removed.\n- We do not `throw` an error when you emit an `error` event and nobody is\n  listening.\n- The `newListener` event is removed as the use-cases for this functionality are\n  really just edge cases.\n- No `setMaxListeners` and it's pointless memory leak warnings. If you want to\n  add `end` listeners you should be able to do that without modules complaining.\n- No `listenerCount` function. Use `EE.listeners(event).length` instead.\n- Support for custom context for events so there is no need to use `fn.bind`.\n- `listeners` method can do existence checking instead of returning only arrays.\n\nIt's a drop in replacement for existing EventEmitters, but just faster. Free\nperformance, who wouldn't want that? The EventEmitter is written in EcmaScript 3\nso it will work in the oldest browsers and node versions that you need to\nsupport.\n\n## Installation\n\n```bash\n$ npm install --save eventemitter3        # npm\n$ component install primus/eventemitter3  # Component\n$ bower install eventemitter3             # Bower\n```\n\n## Usage\n\nAfter installation the only thing you need to do is require the module:\n\n```js\nvar EventEmitter = require('eventemitter3');\n```\n\nAnd you're ready to create your own EventEmitter instances. For the API\ndocumentation, please follow the official Node.js documentation:\n\nhttp://nodejs.org/api/events.html\n\n### Contextual emits\n\nWe've upgraded the API of the `EventEmitter.on`, `EventEmitter.once` and\n`EventEmitter.removeListener` to accept an extra argument which is the `context`\nor `this` value that should be set for the emitted events. This means you no\nlonger have the overhead of an event that required `fn.bind` in order to get a\ncustom `this` value.\n\n```js\nvar EE = new EventEmitter()\n  , context = { foo: 'bar' };\n\nfunction emitted() {\n  console.log(this === context); // true\n}\n\nEE.once('event-name', emitted, context);\nEE.on('another-event', emitted, context);\nEE.removeListener('another-event', emitted, context);\n```\n\n### Existence\n\nTo check if there is already a listener for a given event you can supply the\n`listeners` method with an extra boolean argument. This will transform the\noutput from an array, to a boolean value which indicates if there are listeners\nin place for the given event:\n\n```js\nvar EE = new EventEmitter();\nEE.once('event-name', function () {});\nEE.on('another-event', function () {});\n\nEE.listeners('event-name', true); // returns true\nEE.listeners('unknown-name', true); // returns false\n```\n\n## License\n\n[MIT](LICENSE)\n",
+  "readmeFilename": "README.md",
+  "_id": "eventemitter3@1.1.1",
+  "dist": {
+    "shasum": "31259593713307523728417c48b16469743f177c"
+  },
+  "_from": "eventemitter3@1.x.x",
+  "_resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-1.1.1.tgz"
+}

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/requires-port/.npmignore

@@ -0,0 +1,2 @@
+node_modules
+coverage

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/requires-port/.travis.yml

@@ -0,0 +1,28 @@
+language: node_js
+node_js:
+  - "0.12"
+  - "0.11"
+  - "0.10"
+  - "0.9"
+  - "0.8"
+  - "iojs-v1.1"
+  - "iojs-v1.0"
+before_install:
+  - "npm install -g npm@1.4.x"
+script:
+  - "npm run test-travis"
+after_script:
+  - "npm install coveralls@2.11.x && cat coverage/lcov.info | coveralls"
+matrix:
+  fast_finish: true
+  allow_failures:
+    - node_js: "0.11"
+    - node_js: "0.9"
+    - node_js: "iojs-v1.1"
+    - node_js: "iojs-v1.0"
+notifications:
+  irc:
+    channels:
+      - "irc.freenode.org#unshift"
+    on_success: change
+    on_failure: change

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/requires-port/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Unshift.io, Arnout Kazemier,  the Contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/requires-port/README.md

@@ -0,0 +1,47 @@
+# requires-port
+
+[![Made by unshift](https://img.shields.io/badge/made%20by-unshift-00ffcc.svg?style=flat-square)](http://unshift.io)[![Version npm](http://img.shields.io/npm/v/requires-port.svg?style=flat-square)](http://browsenpm.org/package/requires-port)[![Build Status](http://img.shields.io/travis/unshiftio/requires-port/master.svg?style=flat-square)](https://travis-ci.org/unshiftio/requires-port)[![Dependencies](https://img.shields.io/david/unshiftio/requires-port.svg?style=flat-square)](https://david-dm.org/unshiftio/requires-port)[![Coverage Status](http://img.shields.io/coveralls/unshiftio/requires-port/master.svg?style=flat-square)](https://coveralls.io/r/unshiftio/requires-port?branch=master)[![IRC channel](http://img.shields.io/badge/IRC-irc.freenode.net%23unshift-00a8ff.svg?style=flat-square)](http://webchat.freenode.net/?channels=unshift)
+
+The module name says it all, check if a protocol requires a given port.
+
+## Installation
+
+This module is intended to be used with browserify or Node.js and is distributed
+in the public npm registry. To install it simply run the following command from
+your CLI:
+
+```j
+npm install --save requires-port
+```
+
+## Usage
+
+The module exports it self as function and requires 2 arguments:
+
+1. The port number, can be a string or number.
+2. Protocol, can be `http`, `http:` or even `https://yomoma.com`. We just split
+   it at `:` and use the first result. We currently accept the following
+   protocols:
+   - `http`
+   - `https`
+   - `ws`
+   - `wss`
+   - `ftp`
+   - `gopher`
+   - `file`
+
+It returns a boolean that indicates if protocol requires this port to be added
+to your URL.
+
+```js
+'use strict';
+
+var required = require('requires-port');
+
+console.log(required('8080', 'http')) // true
+console.log(required('80', 'http'))   // false
+```
+
+# License
+
+MIT

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/requires-port/index.js

@@ -0,0 +1,38 @@
+'use strict';
+
+/**
+ * Check if we're required to add a port number.
+ *
+ * @see https://url.spec.whatwg.org/#default-port
+ * @param {Number|String} port Port number we need to check
+ * @param {String} protocol Protocol we need to check against.
+ * @returns {Boolean} Is it a default port for the given protocol
+ * @api private
+ */
+module.exports = function required(port, protocol) {
+  protocol = protocol.split(':')[0];
+  port = +port;
+
+  if (!port) return false;
+
+  switch (protocol) {
+    case 'http':
+    case 'ws':
+    return port !== 80;
+
+    case 'https':
+    case 'wss':
+    return port !== 443;
+
+    case 'ftp':
+    return port !== 22;
+
+    case 'gopher':
+    return port !== 70;
+
+    case 'file':
+    return false;
+  }
+
+  return port !== 0;
+};

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/requires-port/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "requires-port",
+  "version": "0.0.1",
+  "description": "Check if a protocol requires a certain port number to be added to an URL.",
+  "main": "index.js",
+  "scripts": {
+    "100%": "istanbul check-coverage --statements 100 --functions 100 --lines 100 --branches 100",
+    "test": "mocha test.js",
+    "watch": "mocha --watch test.js",
+    "coverage": "istanbul cover ./node_modules/.bin/_mocha -- test.js",
+    "test-travis": "istanbul cover node_modules/.bin/_mocha --report lcovonly -- test.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/unshiftio/requires-port"
+  },
+  "keywords": [
+    "port",
+    "require",
+    "http",
+    "https",
+    "ws",
+    "wss",
+    "gopher",
+    "file",
+    "ftp",
+    "requires",
+    "requried",
+    "portnumber",
+    "url",
+    "parsing",
+    "validation",
+    "cows"
+  ],
+  "author": {
+    "name": "Arnout Kazemier"
+  },
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/unshiftio/requires-port/issues"
+  },
+  "homepage": "https://github.com/unshiftio/requires-port",
+  "devDependencies": {
+    "assume": "1.1.x",
+    "istanbul": "0.3.x",
+    "mocha": "2.1.x",
+    "pre-commit": "1.0.x"
+  },
+  "readme": "# requires-port\n\n[![Made by unshift](https://img.shields.io/badge/made%20by-unshift-00ffcc.svg?style=flat-square)](http://unshift.io)[![Version npm](http://img.shields.io/npm/v/requires-port.svg?style=flat-square)](http://browsenpm.org/package/requires-port)[![Build Status](http://img.shields.io/travis/unshiftio/requires-port/master.svg?style=flat-square)](https://travis-ci.org/unshiftio/requires-port)[![Dependencies](https://img.shields.io/david/unshiftio/requires-port.svg?style=flat-square)](https://david-dm.org/unshiftio/requires-port)[![Coverage Status](http://img.shields.io/coveralls/unshiftio/requires-port/master.svg?style=flat-square)](https://coveralls.io/r/unshiftio/requires-port?branch=master)[![IRC channel](http://img.shields.io/badge/IRC-irc.freenode.net%23unshift-00a8ff.svg?style=flat-square)](http://webchat.freenode.net/?channels=unshift)\n\nThe module name says it all, check if a protocol requires a given port.\n\n## Installation\n\nThis module is intended to be used with browserify or Node.js and is distributed\nin the public npm registry. To install it simply run the following command from\nyour CLI:\n\n```j\nnpm install --save requires-port\n```\n\n## Usage\n\nThe module exports it self as function and requires 2 arguments:\n\n1. The port number, can be a string or number.\n2. Protocol, can be `http`, `http:` or even `https://yomoma.com`. We just split\n   it at `:` and use the first result. We currently accept the following\n   protocols:\n   - `http`\n   - `https`\n   - `ws`\n   - `wss`\n   - `ftp`\n   - `gopher`\n   - `file`\n\nIt returns a boolean that indicates if protocol requires this port to be added\nto your URL.\n\n```js\n'use strict';\n\nvar required = require('requires-port');\n\nconsole.log(required('8080', 'http')) // true\nconsole.log(required('80', 'http'))   // false\n```\n\n# License\n\nMIT\n",
+  "readmeFilename": "README.md",
+  "_id": "requires-port@0.0.1",
+  "dist": {
+    "shasum": "b18d21f3826ba3a3ab65491150c3cbcac1481854"
+  },
+  "_from": "requires-port@0.x.x",
+  "_resolved": "https://registry.npmjs.org/requires-port/-/requires-port-0.0.1.tgz"
+}

server/node_modules/cors-anywhere/node_modules/http-proxy/node_modules/requires-port/test.js

@@ -0,0 +1,98 @@
+describe('requires-port', function () {
+  'use strict';
+
+  var assume = require('assume')
+    , required = require('./');
+
+  it('is exported as a function', function () {
+    assume(required).is.a('function');
+  });
+
+  it('does not require empty ports', function () {
+    assume(required('', 'http')).false();
+    assume(required('', 'wss')).false();
+    assume(required('', 'ws')).false();
+    assume(required('', 'cowsack')).false();
+  });
+
+  it('assumes true for unknown protocols',function () {
+    assume(required('808', 'foo')).true();
+    assume(required('80', 'bar')).true();
+  });
+
+  it('never requires port numbers for file', function () {
+    assume(required(8080, 'file')).false();
+  });
+
+  it('does not require port 80 for http', function () {
+    assume(required('80', 'http')).false();
+    assume(required(80, 'http')).false();
+    assume(required(80, 'http://')).false();
+    assume(required(80, 'http://www.google.com')).false();
+
+    assume(required('8080', 'http')).true();
+    assume(required(8080, 'http')).true();
+    assume(required(8080, 'http://')).true();
+    assume(required(8080, 'http://www.google.com')).true();
+  });
+
+  it('does not require port 80 for ws', function () {
+    assume(required('80', 'ws')).false();
+    assume(required(80, 'ws')).false();
+    assume(required(80, 'ws://')).false();
+    assume(required(80, 'ws://www.google.com')).false();
+
+    assume(required('8080', 'ws')).true();
+    assume(required(8080, 'ws')).true();
+    assume(required(8080, 'ws://')).true();
+    assume(required(8080, 'ws://www.google.com')).true();
+  });
+
+  it('does not require port 443 for https', function () {
+    assume(required('443', 'https')).false();
+    assume(required(443, 'https')).false();
+    assume(required(443, 'https://')).false();
+    assume(required(443, 'https://www.google.com')).false();
+
+    assume(required('8080', 'https')).true();
+    assume(required(8080, 'https')).true();
+    assume(required(8080, 'https://')).true();
+    assume(required(8080, 'https://www.google.com')).true();
+  });
+
+  it('does not require port 443 for wss', function () {
+    assume(required('443', 'wss')).false();
+    assume(required(443, 'wss')).false();
+    assume(required(443, 'wss://')).false();
+    assume(required(443, 'wss://www.google.com')).false();
+
+    assume(required('8080', 'wss')).true();
+    assume(required(8080, 'wss')).true();
+    assume(required(8080, 'wss://')).true();
+    assume(required(8080, 'wss://www.google.com')).true();
+  });
+
+  it('does not require port 22 for ftp', function () {
+    assume(required('22', 'ftp')).false();
+    assume(required(22, 'ftp')).false();
+    assume(required(22, 'ftp://')).false();
+    assume(required(22, 'ftp://www.google.com')).false();
+
+    assume(required('8080', 'ftp')).true();
+    assume(required(8080, 'ftp')).true();
+    assume(required(8080, 'ftp://')).true();
+    assume(required(8080, 'ftp://www.google.com')).true();
+  });
+
+  it('does not require port 70 for gopher', function () {
+    assume(required('70', 'gopher')).false();
+    assume(required(70, 'gopher')).false();
+    assume(required(70, 'gopher://')).false();
+    assume(required(70, 'gopher://www.google.com')).false();
+
+    assume(required('8080', 'gopher')).true();
+    assume(required(8080, 'gopher')).true();
+    assume(required(8080, 'gopher://')).true();
+    assume(required(8080, 'gopher://www.google.com')).true();
+  });
+});

server/node_modules/cors-anywhere/server.js

@@ -0,0 +1,23 @@
+// Heroku defines the environment variable PORT, and requires the binding address to be 0.0.0.0
+var host = process.env.PORT ? '0.0.0.0' : '127.0.0.1';
+var port = process.env.PORT || 8080;
+
+var cors_proxy = require('./lib/cors-anywhere');
+cors_proxy.createServer({
+    requireHeader: ['origin', 'x-requested-with'],
+    removeHeaders: [
+        'cookie',
+        'cookie2',
+        // Strip Heroku-specific headers
+        'x-heroku-queue-wait-time',
+        'x-heroku-queue-depth',
+        'x-heroku-dynos-in-use',
+        'x-request-start'
+    ],
+    httpProxyOptions: {
+        // Do not add X-Forwarded-For, etc. headers, because Heroku already adds it.
+        xfwd: false
+    }
+}).listen(port, host, function() {
+    console.log('Running CORS Anywhere on ' + host + ':' + port);
+});

server/node_modules/cors-anywhere/test-old-for-leak-testing/runner.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+// Go to the end of the file to see the declarations of the tests
+
+// jshint node:true, sub:true
+'use strict';
+var http = require('http');
+var assert = require('assert');
+var fork = require('child_process').fork;
+var exec = require('child_process').exec;
+
+var host = '127.0.0.1';
+// CORS Anywhere API endpoint
+var port = 11400;
+var cors_api_url = 'http://' + host + ':' + port + '/';
+// Server with redirects
+var portServer = 11302;
+var no_cors_url = 'http://' + host + ':' + portServer + '/';
+// Memleak debugging server
+var portLeak = process.env.DEBUG_PORT = 9998;
+
+
+setupRedirectServer(function() {
+    setupCORSServer(function(activateDevtoolsAgent) {
+        runTest(function() {
+            if (activateDevtoolsAgent) {
+                activateDevtoolsAgent();
+                suggestLeakTest();
+            } else {
+                console.log('Leak tests not run.');
+                process.exit();
+            }
+        });
+    });
+});
+
+/**
+ * @param callback {function(activateDevtoolsAgent)} activateDevtoolsAgent is a function
+ *  if the devtools agent is available, omitted otherwise.
+ */
+function setupCORSServer(callback) {
+    var child = fork('./sub-server', [host, port], {cwd: __dirname});
+    child.on('message', function(message) {
+        if (message.hasDevtoolsAgent) {
+            callback(function() {
+               child.kill('SIGUSR2');
+               child = null;
+            });
+        } else if (message.hasDevtoolsAgent === false) {
+            callback();
+        } else if (message.action === 'leakTest') {
+            runLeakTest(message.parallel, message.requestCount);
+        } else {
+            console.error('Unexpected message: ', message);
+        }
+    });
+}
+
+function setupRedirectServer(callback) {
+    var child = fork('./sub-no-cors-server', [host, portServer], {cwd: __dirname});
+    child.once('message', function() {
+        callback();
+    });
+}
+
+//
+// Actual tests
+//
+
+function runTest(callback) {
+    var url = cors_api_url + no_cors_url + '2';
+    console.log('Test, GET: ' + url);
+    http.get(url, function(res) {
+        console.log('');
+        assert.equal(res.statusCode, 200, 'HTTP status must be 200');
+        console.log('Response headers:', res.headers);
+        assert.equal(res.headers['access-control-allow-origin'], '*');
+        assert.equal(res.headers['whatever'], 'header', 'Custom header must be passed through.');
+        assert.equal(res.headers['x-request-url'], no_cors_url + '2', 'x-request-url should match original URL');
+        assert.equal(res.headers['x-final-url'], no_cors_url + '0', 'x-final-url should match the last URL');
+        assert(!res.headers['set-cookie'], 'Cookies must be absent');
+        assert.equal(res.headers['x-cors-redirect-1'], '302 ' + no_cors_url + '1', 'x-cors-redirect-1 must provide info about redirect');
+        assert.equal(res.headers['x-cors-redirect-2'], '302 ' + no_cors_url + '0', 'x-cors-redirect-2 must provide info about redirect');
+
+        callback();
+    });
+}
+
+function suggestLeakTest() {
+    console.log('1. Visit http://c4milo.github.io/node-webkit-agent/26.0.1410.65/inspector.html?host=localhost:' + portLeak + '&page=0');
+    console.log('2. Go to the profiles tab, select "Take Heap Snapshot" and click "Start"');
+    console.log('3. Go to the JavaScript console, type leakTest() and press Enter');
+    console.log('4. When you see "leakTest done" in the console, take another heap snapshot and use the Comparison option.');
+}
+function runLeakTest(/*boolean*/ parallel, requestCount) {
+    requestCount = +requestCount || 100;
+
+    console.log('Sending ' + requestCount + ' requests');
+
+    var initCount = 0;
+    var doneCount = 0;
+
+    if (parallel) {
+        while (initCount < requestCount) doRequest(); // initCount is incremented in doRequest
+    } else {
+        doRequest();
+    }
+    function onComplete(res) {
+        if (++doneCount % 10 === 0 || doneCount === requestCount) {
+            console.log('done #' + doneCount);
+        }
+        assert.equal(res.statusCode, 200);
+        assert.equal(res.headers['access-control-allow-origin'], '*');
+        assert.equal(res.headers['whatever'], 'header', 'Custom header must be passed through.');
+        if (!parallel && doneCount < requestCount) {
+            doRequest();
+        }
+    }
+    function doRequest() {
+        http.get({
+            agent: false,
+            host: host,
+            port: port,
+            path: '/' + no_cors_url + '1?' + (++initCount) // resource with one redirect
+        }, onComplete);
+    }
+}

server/node_modules/cors-anywhere/test-old-for-leak-testing/sub-no-cors-server.js

@@ -0,0 +1,31 @@
+// jshint node:true
+'use strict';
+
+var host = process.argv[2];
+var port = process.argv[3];
+console.log('Trying to start redirect server on ' + host + ':' + port + '...');
+
+process.on('disconnect', function() {
+    console.log('Stopping redirect server at ' + host + ':' + port + '...\n');
+    process.exit();
+});
+
+var regex = /^\/(\d+)(.*)/;
+require('http').createServer(function(req, res) {
+    // Don't use console.log, because the number of newlines would be too much.
+    process.stdout.write(req.url + ' ');
+    // Redirect a few times. E.g. /3 -> /2 -> /1 -> /0
+    // Preserve any suffix (for cache breaking)
+    var path = regex.exec(req.url);
+    var count = path && +path[1];
+    if (count > 0) {
+        res.writeHead(302, { location: '/' + (count - 1) + path[2] });
+        res.end();
+    } else {
+        res.writeHead(200, { 'whatever':'header', 'Set-Cookie': 'test=1; path=/' });
+        res.end('Ok');
+    }
+}).listen(port, host, function() {
+    console.log('Started redirect server at ' + host + ':' + port + '\n');
+    process.send('ready');
+});

server/node_modules/cors-anywhere/test-old-for-leak-testing/sub-server.js

@@ -0,0 +1,42 @@
+// jshint node:true
+'use strict';
+
+var host = process.argv[2];
+var port = process.argv[3];
+console.log('Trying to start CORS Anywhere on ' + host + ':' + port + '...');
+
+process.on('disconnect', function() {
+    console.log('Stopping CORS Anywhere server at ' + host + ':' + port + '...\n');
+    process.exit();
+});
+
+require('../lib/cors-anywhere').createServer().listen(port, host, function() {
+    console.log('Running CORS Anywhere on ' + host + ':' + port + '\n');
+    var hasDevtoolsAgent = false;
+    try {
+        require('webkit-devtools-agent');
+        hasDevtoolsAgent = true;
+    } catch (e) {
+        console.error('Failed to load webkit-devtools-agent. Memory leak testing is not available');
+        console.error('Install it using  npm install webkit-devtools-agent');
+    }
+    process.send({
+        hasDevtoolsAgent: hasDevtoolsAgent
+    });
+});
+
+global.leakTest = function leakTest(parallel, requestCount) {
+    // parallel {boolean} If true, all requests are sent at once.
+    //                    If false, the next request is only sent after completing the previous one (default).
+    // requestCount {number} Number of requests, defaults to 100
+    // All parameters are optional
+    process.send({
+        action: 'leakTest',
+        parallel: parallel,
+        requestCount: requestCount
+    });
+    console.log('Switch to the shell and watch the console for the completion message.');
+};
+global.leakTestParallel = function leakTestParallel(requestCount) {
+    global.leakTest(true, requestCount);
+};

server/node_modules/cors-anywhere/test/cert.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBsTCCARoCCQDp0DuED0RAJzANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJj
+b3JzLWFueXdoZXJlIHRlc3QwHhcNMTUwNTA2MDcyOTM1WhcNMTUwNjA1MDcyOTM1
+WjAdMRswGQYDVQQDDBJjb3JzLWFueXdoZXJlIHRlc3QwgZ8wDQYJKoZIhvcNAQEB
+BQADgY0AMIGJAoGBALzTF5ClJKvkB6h9h7kLORV+mMV3ySDs+oGZn0NgXM+yb9Zh
+69r5e95zZJl/V432LFdy0hkEcVteUkC2REWG8D4COGfiwWsXyZdaP1qqLpDpPAMm
+v6xFHjW6rVuxzfr4GUjE0Zh9Fg2R2SbtCOcHS/LZoDVOqOvn6+urP6XFY4aFAgMB
+AAEwDQYJKoZIhvcNAQELBQADgYEAYXMhS8ouff/c8lSUUs/CLh010cj5RPk/ivS7
+aN2PArzQ6pZvhpgJKf7XAQksBtLYYZMzIpG6W8zhPSbqzly7lELAdE+sxcbbfu8A
+FMjNVFQ2Fm1c8ImX8qpE3nhVrPAiwfPjGBqKHTl730gvbh1XH9TC4O4dZcbEomX3
+5MsxQfc=
+-----END CERTIFICATE-----

server/node_modules/cors-anywhere/test/child.js

@@ -0,0 +1,64 @@
+// When this module is loaded, CORS Anywhere is started.
+// Then, a request is generated to warm up the server (just in case).
+// Then the base URL of CORS Anywhere is sent to the parent process.
+// ...
+// When the parent process is done, it sends an empty message to this child
+// process, which in turn records the change in used heap space.
+// The difference in heap space is finally sent back to the parent process.
+// ...
+// The parent process should then kill this child.
+
+process.on('uncaughtException', function(e) {
+  console.error('Uncaught exception in child process: ' + e);
+  console.error(e.stack);
+  process.exit(-1);
+});
+
+// Invoke memoryUsage() without using its result to make sure that any internal
+// datastructures that supports memoryUsage() is initialized and won't pollute
+// the memory usage measurement later on.
+process.memoryUsage();
+
+var heapUsedStart = 0;
+function getMemoryUsage(callback) {
+  // Note: Requires --expose-gc
+  // 6 is the minimum amount of gc() calls before calling gc() again does not
+  // reduce memory any more.
+  for (var i = 0; i < 6; ++i) {
+    global.gc();
+  }
+  callback(process.memoryUsage().heapUsed);
+}
+
+var server;
+if (process.argv.indexOf('use-http-instead-of-cors-anywhere') >= 0) {
+  server = require('http').createServer(function(req, res) { res.end(); });
+} else {
+  server = require('../').createServer();
+}
+
+server.listen(0, function() {
+  // Perform 1 request to warm up.
+  require('http').get({
+    hostname: '127.0.0.1',
+    port: server.address().port,
+    path: '/http://invalid:99999',
+    agent: false,
+  }, function() {
+    notifyParent();
+  });
+
+  function notifyParent() {
+    getMemoryUsage(function(usage) {
+      heapUsedStart = usage;
+      process.send('http://127.0.0.1:' + server.address().port + '/');
+    });
+  }
+});
+
+process.once('message', function() {
+  getMemoryUsage(function(heapUsedEnd) {
+    var delta = heapUsedEnd - heapUsedStart;
+    process.send(delta);
+  });
+});

server/node_modules/cors-anywhere/test/dummy.txt

@@ -0,0 +1 @@
+dummy content

server/node_modules/cors-anywhere/test/key.pem

@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQC80xeQpSSr5AeofYe5CzkVfpjFd8kg7PqBmZ9DYFzPsm/WYeva
++Xvec2SZf1eN9ixXctIZBHFbXlJAtkRFhvA+Ajhn4sFrF8mXWj9aqi6Q6TwDJr+s
+RR41uq1bsc36+BlIxNGYfRYNkdkm7QjnB0vy2aA1Tqjr5+vrqz+lxWOGhQIDAQAB
+AoGBAISy8OelN01Zlowxk/VWTsqtSl3UHdP21uHHfWaTTQZlxzTpYiBknkmp3LQH
+CxfoPidCuSX9ulBUzAdQUFBwUVp8wyPIRjpNyRiD58dLNxG0G+OACqnLxNWqIf6F
+vS3UqrRGIA5u+GSz+0g3DAeVA5JmsAyHQGkJsh3pcuD8/7wNAkEA7MScGfySy9td
+dDBekVU5/GaVg4DA4ELtDNfa99ARB89XP0ps/XrOPEL9yxTjWIHH+qxuhpfG6zGN
+ouxZlvBT9wJBAMwpig4A4JE8M8pBDwMY4213gud8B1grQTbhz5bv51aTaIEQFcxw
+sGfEmAfVToI+kVTrdFggy42YCSMSvwuF4mMCQQDZHkqPwf/TlSwT2i8+UstD28aL
+uswkWvsKZf9UdKbJZKd7UIK1x6HLvRsC2frJNOnvw6PvJMuy7dQWbWqScXxtAkBv
+/5msdO68vbnriiUiHdUliBpXwsKEq7Xq1ZV7x7+wzszVgG106ZzcUAzWvz2CVbCE
+VWZNsi/4TR82DmKff6LhAkBA/xceWaZjxh5dkWkIrMFWd2GFhGlpfwYw7oELwRL8
+RYXzc1Mr2fDdZDgwgjg67JQqIhOQ3E4RGKPgZ+E7Pk3/
+-----END RSA PRIVATE KEY-----

server/node_modules/cors-anywhere/test/setup.js

@@ -0,0 +1,103 @@
+var nock = require('nock');
+
+nock.enableNetConnect('127.0.0.1');
+
+function echoheaders(origin) {
+  nock(origin)
+    .persist()
+    .get('/echoheaders')
+    .reply(function(uri) {
+      var headers = this.req.headers;
+      var excluded_headers = [
+        'accept-encoding',
+        'user-agent',
+        'connection',
+        // Remove this header since its value is platform-specific.
+        'x-forwarded-for',
+        'test-include-xfwd',
+      ];
+      if (!('test-include-xfwd' in headers)) {
+        excluded_headers.push('x-forwarded-port');
+        excluded_headers.push('x-forwarded-proto');
+      }
+      var response = {};
+      Object.keys(headers).forEach(function(name) {
+        if (excluded_headers.indexOf(name) === -1) {
+          response[name] = headers[name];
+        }
+      });
+      return response;
+    });
+}
+
+nock('http://example.com')
+  .persist()
+  .get('/')
+  .reply(200, 'Response from example.com')
+
+  .post('/echopost')
+  .reply(200, function(uri, requestBody) {
+    return requestBody;
+  })
+
+  .get('/setcookie')
+  .reply(200, '', {
+    'Set-Cookie': 'x',
+    'Set-Cookie2': 'y',
+    'Set-Cookie3': 'z', // This is not a special cookie setting header.
+  })
+
+  .get('/redirecttarget')
+  .reply(200, 'redirect target', {
+    'Some header': 'value'
+  })
+
+  .head('/redirect')
+  .reply(302, '', {
+    'Location': '/redirecttarget'
+  })
+
+  .get('/redirect')
+  .reply(302, 'redirecting...', {
+    'header at redirect': 'should not be here',
+    'Location': '/redirecttarget'
+  })
+
+  .get('/redirectposttarget')
+  .reply(200, 'post target')
+
+  .post('/redirectposttarget')
+  .reply(200, 'post target (POST)')
+
+  .post('/redirectpost')
+  .reply(302, 'redirecting...', {
+    'Location': '/redirectposttarget'
+  })
+
+  .post('/redirect307')
+  .reply(307, 'redirecting...', {
+    'Location': '/redirectposttarget'
+  })
+
+  .get('/redirect2redirect')
+  .reply(302, 'redirecting to redirect...', {
+    'Location': '/redirect'
+  })
+
+  .get('/redirectloop')
+  .reply(302, 'redirecting ad infinitum...', {
+    'Location': '/redirectloop'
+  })
+
+  .get('/proxyerror')
+  .replyWithError('throw node')
+;
+
+echoheaders('http://example.com');
+echoheaders('http://example.com:1337');
+echoheaders('https://example.com');
+echoheaders('https://example.com:1337');
+
+nock('http://robots.txt')
+  .get('/')
+  .reply(200, 'this is http://robots.txt');

server/node_modules/cors-anywhere/test/test-memory.js

@@ -0,0 +1,110 @@
+// Run this specific test using:
+// npm test -- -f memory
+var http = require('http');
+var path = require('path');
+var url = require('url');
+var fork = require('child_process').fork;
+
+describe('memory usage', function() {
+  var cors_api_url;
+
+  var server;
+  var cors_anywhere_child;
+  before(function(done) {
+    server = http.createServer(function(req, res) {
+      res.writeHead(200);
+      res.end();
+    }).listen(0, function() {
+      done();
+    });
+  });
+
+  after(function(done) {
+    server.close(function() {
+      done();
+    });
+  });
+
+  beforeEach(function(done) {
+    var cors_module_path = path.join(__dirname, 'child');
+    var args = [];
+    // Uncomment this if you want to compare the performance of CORS Anywhere
+    // with the standard no-op http module.
+    // args.push('use-http-instead-of-cors-anywhere');
+    cors_anywhere_child = fork(cors_module_path, args, {
+      execArgv: ['--expose-gc'],
+    });
+    cors_anywhere_child.once('message', function(cors_url) {
+      cors_api_url = cors_url;
+      done();
+    });
+  });
+
+  afterEach(function() {
+    cors_anywhere_child.kill();
+  });
+
+  /**
+   * Perform N CORS Anywhere proxy requests to a simple test server.
+   *
+   * @param {number} n - number of repetitions.
+   * @param {number} requestSize - Approximate size of request in kilobytes.
+   * @param {number} memMax - Expected maximum memory usage in kilobytes.
+   * @param {function} done - Upon success, called without arguments.
+   *   Upon failure, called with the error as parameter.
+   */
+  function performNRequests(n, requestSize, memMax, done) {
+    var remaining = n;
+    var request = url.parse(
+        cors_api_url + 'http://127.0.0.1:' + server.address().port);
+    request.agent = false; // Force Connection: Close
+    request.headers = {
+      'Long header': new Array(requestSize * 1e3).join('x'),
+    };
+    (function requestAgain() {
+      if (remaining-- === 0) {
+        cors_anywhere_child.once('message', function(memory_usage_delta) {
+          console.log('Memory usage delta: ' + memory_usage_delta +
+              ' (' + n + ' requests of ' + requestSize + ' kb each)');
+          if (memory_usage_delta > memMax * 1e3) {
+            // Note: Even if this error is reached, always profile (e.g. using
+            // node-inspector) whether it is a true leak, and not e.g. noise
+            // caused by the implementation of V8/Node.js.
+            // Uncomment args.push('use-http-instead-of-cors-anywhere') at the
+            // fork() call to get a sense of what's normal.
+            throw new Error('Possible memory leak: ' + memory_usage_delta +
+                ' bytes was not released, which exceeds the ' + memMax +
+                ' kb limit by ' +
+                Math.round(memory_usage_delta / memMax / 10 - 100) + '%.');
+          }
+          done();
+        });
+        cors_anywhere_child.send(null);
+        return;
+      }
+      http.request(request, function() {
+        requestAgain();
+      }).on('error', function(error) {
+        done(error);
+      }).end();
+    })();
+  }
+
+  it('100 GET requests 50k', function(done) {
+    // This test is just for comparison with the following tests.
+    performNRequests(100, 50, 550, done);
+  });
+
+  // 100x 1k and 100x 50k for comparison.
+  // Both should use about the same amount of memory if there is no leak.
+  it('1000 GET requests 1k', function(done) {
+    // Every request should complete within 10ms.
+    this.timeout(1000 * 10);
+    performNRequests(1000, 1, 2000, done);
+  });
+  it('1000 GET requests 50k', function(done) {
+    // Every request should complete within 10ms.
+    this.timeout(1000 * 10);
+    performNRequests(1000, 50, 2000, done);
+  });
+});

server/node_modules/cors-anywhere/test/test.js

@@ -0,0 +1,435 @@
+require('./setup');
+
+var createServer = require('../').createServer;
+var request = require('supertest');
+var path = require('path');
+var fs = require('fs');
+var assert = require('assert');
+
+var helpTextPath = path.join(__dirname, '../lib/help.txt');
+var helpText = fs.readFileSync(helpTextPath, { encoding: 'utf8' });
+
+request.Test.prototype.expectJSON = function(json, done) {
+  this.expect(function(res) {
+    // Assume that the response can be parsed as JSON (otherwise it throws).
+    var actual = JSON.parse(res.text);
+    assert.deepEqual(actual, json);
+  });
+  return done ? this.end(done) : this;
+};
+
+request.Test.prototype.expectNoHeader = function(header, done) {
+  this.expect(function(res) {
+    if (header.toLowerCase() in res.headers) {
+      return 'Unexpected header in response: ' + header;
+    }
+  });
+  return done ? this.end(done) : this;
+};
+
+var cors_anywhere;
+var cors_anywhere_port;
+function stopServer(done) {
+  cors_anywhere.close(function() {
+    done();
+  });
+  cors_anywhere = null;
+}
+
+describe('Basic functionality', function() {
+  before(function() {
+    cors_anywhere = createServer();
+    cors_anywhere_port = cors_anywhere.listen(0).address().port;
+  });
+  after(stopServer);
+
+  it('GET /', function(done) {
+    request(cors_anywhere)
+      .get('/')
+      .type('text/plain')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, helpText, done);
+  });
+
+  it('GET /iscorsneeded', function(done) {
+    request(cors_anywhere)
+      .get('/iscorsneeded')
+      .expectNoHeader('access-control-allow-origin', done);
+  });
+
+  it('GET /example.com:65536', function(done) {
+    request(cors_anywhere)
+      .get('/example.com:65536')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(400, 'Port number too large: 65536', done);
+  });
+
+  it('GET /favicon.ico', function(done) {
+    request(cors_anywhere)
+      .get('/favicon.ico')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(404, 'Invalid host: favicon.ico', done);
+  });
+
+  it('GET /robots.txt', function(done) {
+    request(cors_anywhere)
+      .get('/robots.txt')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(404, 'Invalid host: robots.txt', done);
+  });
+
+  it('GET /http://robots.txt should be proxied', function(done) {
+    request(cors_anywhere)
+      .get('/http://robots.txt')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, 'this is http://robots.txt', done);
+  });
+
+  it('GET /example.com', function(done) {
+    request(cors_anywhere)
+      .get('/example.com')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('x-request-url', 'http://example.com/')
+      .expect(200, 'Response from example.com', done);
+  });
+
+  it('GET //example.com', function(done) {
+    // '/example.com' is an invalid URL.
+    request(cors_anywhere)
+      .get('//example.com')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, helpText, done);
+  });
+
+  it('GET ///example.com', function(done) {
+    // API base URL (with trailing slash) + '//example.com'
+    request(cors_anywhere)
+      .get('///example.com')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('x-request-url', 'http://example.com/')
+      .expect(200, 'Response from example.com', done);
+  });
+
+  it('GET /http://example.com', function(done) {
+    request(cors_anywhere)
+      .get('/http://example.com')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('x-request-url', 'http://example.com/')
+      .expect(200, 'Response from example.com', done);
+  });
+
+  it('POST plain text', function(done) {
+    request(cors_anywhere)
+      .post('/example.com/echopost')
+      .send('{"this is a request body & should not be mangled":1.00}')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('{"this is a request body & should not be mangled":1.00}', done);
+  });
+
+  it('POST file', function(done) {
+    request(cors_anywhere)
+      .post('/example.com/echopost')
+      .attach('file', path.join(__dirname, 'dummy.txt'))
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(/\r\nContent-Disposition: form-data; name="file"; filename="dummy.txt"\r\nContent-Type: text\/plain\r\n\r\ndummy content\n\r\n/, done);
+  });
+
+  it('HEAD with redirect should be followed', function(done) {
+    // Redirects are automatically followed, because redirects are to be
+    // followed automatically per specification regardless of the HTTP verb.
+    request(cors_anywhere)
+      .head('/example.com/redirect')
+      .redirects(0)
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('some header', 'value')
+      .expect('x-request-url', 'http://example.com/redirect')
+      .expect('x-cors-redirect-1', '302 http://example.com/redirecttarget')
+      .expect('x-final-url', 'http://example.com/redirecttarget')
+      .expect('access-control-expose-headers', /some header,x-final-url/)
+      .expectNoHeader('header at redirect')
+      .expect(200, '', done);
+  });
+
+  it('GET with redirect should be followed', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/redirect')
+      .redirects(0)
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('some header', 'value')
+      .expect('x-request-url', 'http://example.com/redirect')
+      .expect('x-cors-redirect-1', '302 http://example.com/redirecttarget')
+      .expect('x-final-url', 'http://example.com/redirecttarget')
+      .expect('access-control-expose-headers', /some header,x-final-url/)
+      .expectNoHeader('header at redirect')
+      .expect(200, 'redirect target', done);
+  });
+
+  it('GET with redirect loop should interrupt', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/redirectloop')
+      .redirects(0)
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('x-request-url', 'http://example.com/redirectloop')
+      .expect('x-cors-redirect-1', '302 http://example.com/redirectloop')
+      .expect('x-cors-redirect-2', '302 http://example.com/redirectloop')
+      .expect('x-cors-redirect-3', '302 http://example.com/redirectloop')
+      .expect('x-cors-redirect-4', '302 http://example.com/redirectloop')
+      .expect('x-cors-redirect-5', '302 http://example.com/redirectloop')
+      .expect('Location', /^http:\/\/127.0.0.1:\d+\/http:\/\/example.com\/redirectloop$/)
+      .expect(302, 'redirecting ad infinitum...', done);
+  });
+
+  it('POST with 302 redirect should be followed', function(done) {
+    request(cors_anywhere)
+      .post('/example.com/redirectpost')
+      .redirects(0)
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('x-request-url', 'http://example.com/redirectpost')
+      .expect('x-cors-redirect-1', '302 http://example.com/redirectposttarget')
+      .expect('x-final-url', 'http://example.com/redirectposttarget')
+      .expect('access-control-expose-headers', /x-final-url/)
+      .expect(200, 'post target', done);
+  });
+
+  it('POST with 307 redirect should not be handled', function(done) {
+    // Because of implementation difficulties (having to keep the request body
+    // in memory), handling HTTP 307/308 redirects is deferred to the requestor.
+    request(cors_anywhere)
+      .post('/example.com/redirect307')
+      .redirects(0)
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('x-request-url', 'http://example.com/redirect307')
+      .expect('Location', /^http:\/\/127.0.0.1:\d+\/http:\/\/example.com\/redirectposttarget$/)
+      .expect('x-final-url', 'http://example.com/redirect307')
+      .expect('access-control-expose-headers', /x-final-url/)
+      .expect(307, 'redirecting...', done);
+  });
+
+  it('OPTIONS /', function(done) {
+    request(cors_anywhere)
+      .options('/')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, '', done);
+  });
+
+  it('OPTIONS / with Access-Control-Request-Method / -Headers', function(done) {
+    request(cors_anywhere)
+      .options('/')
+      .set('Access-Control-Request-Method', 'DELETE')
+      .set('Access-Control-Request-Headers', 'X-Tralala')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('Access-Control-Allow-Methods', 'DELETE')
+      .expect('Access-Control-Allow-Headers', 'X-Tralala')
+      .expect(200, '', done);
+  });
+
+  it('OPTIONS //bogus', function(done) {
+    // The preflight request always succeeds, regardless of whether the request
+    // is valid.
+    request(cors_anywhere)
+      .options('//bogus')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, '', done);
+  });
+
+  it('X-Forwarded-* headers', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/echoheaders')
+      .set('test-include-xfwd', '')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expectJSON({
+        host: 'example.com',
+        'x-forwarded-port': String(cors_anywhere_port),
+        'x-forwarded-proto': 'http',
+      }, done);
+  });
+
+  it('X-Forwarded-* headers (non-standard port)', function(done) {
+    request(cors_anywhere)
+      .get('/example.com:1337/echoheaders')
+      .set('test-include-xfwd', '')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expectJSON({
+        host: 'example.com:1337',
+        'x-forwarded-port': String(cors_anywhere_port),
+        'x-forwarded-proto': 'http',
+      }, done);
+  });
+
+  it('X-Forwarded-* headers (https)', function(done) {
+    request(cors_anywhere)
+      .get('/https://example.com/echoheaders')
+      .set('test-include-xfwd', '')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expectJSON({
+        host: 'example.com',
+        'x-forwarded-port': String(cors_anywhere_port),
+        'x-forwarded-proto': 'http',
+      }, done);
+  });
+
+  it('Ignore cookies', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/setcookie')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect('Set-Cookie3', 'z')
+      .expectNoHeader('set-cookie')
+      .expectNoHeader('set-cookie2', done);
+  });
+
+  it('Proxy error', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/proxyerror')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(404, 'Not found because of proxy error: Error: throw node', done);
+  });
+});
+
+describe('server on https', function() {
+  var NODE_TLS_REJECT_UNAUTHORIZED;
+  before(function() {
+    cors_anywhere = createServer({
+      httpsOptions: {
+        key: fs.readFileSync(path.join(__dirname, 'key.pem')),
+        cert: fs.readFileSync(path.join(__dirname, 'cert.pem')),
+      },
+    });
+    cors_anywhere_port = cors_anywhere.listen(0).address().port;
+    // Disable certificate validation in case the certificate expires.
+    NODE_TLS_REJECT_UNAUTHORIZED = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+  });
+  after(function(done) {
+    if (NODE_TLS_REJECT_UNAUTHORIZED === undefined) {
+      delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+    } else {
+      process.env.NODE_TLS_REJECT_UNAUTHORIZED = NODE_TLS_REJECT_UNAUTHORIZED;
+    }
+    stopServer(done);
+  });
+
+  it('X-Forwarded-* headers (http)', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/echoheaders')
+      .set('test-include-xfwd', '')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expectJSON({
+        host: 'example.com',
+        'x-forwarded-port': String(cors_anywhere_port),
+        'x-forwarded-proto': 'https',
+      }, done);
+  });
+
+  it('X-Forwarded-* headers (https)', function(done) {
+    request(cors_anywhere)
+      .get('/https://example.com/echoheaders')
+      .set('test-include-xfwd', '')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expectJSON({
+        host: 'example.com',
+        'x-forwarded-port': String(cors_anywhere_port),
+        'x-forwarded-proto': 'https',
+      }, done);
+  });
+
+  it('X-Forwarded-* headers (https, non-standard port)', function(done) {
+    request(cors_anywhere)
+      .get('/https://example.com:1337/echoheaders')
+      .set('test-include-xfwd', '')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expectJSON({
+        host: 'example.com:1337',
+        'x-forwarded-port': String(cors_anywhere_port),
+        'x-forwarded-proto': 'https',
+      }, done);
+  });
+});
+
+describe('requireHeader', function() {
+  before(function() {
+    cors_anywhere = createServer({
+      requireHeader: ['origin', 'x-requested-with'],
+    });
+    cors_anywhere_port = cors_anywhere.listen(0).address().port;
+  });
+  after(stopServer);
+
+  it('GET /example.com without header', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(400, 'Missing required request header. Must specify one of: origin,x-requested-with', done);
+  });
+
+  it('GET /example.com with X-Requested-With header', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/')
+      .set('X-Requested-With', '')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, done);
+  });
+
+  it('GET /example.com with Origin header', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/')
+      .set('Origin', 'null')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expect(200, done);
+  });
+});
+
+describe('removeHeaders', function() {
+  before(function() {
+    cors_anywhere = createServer({
+      removeHeaders: ['cookie', 'cookie2'],
+    });
+    cors_anywhere_port = cors_anywhere.listen(0).address().port;
+  });
+  after(stopServer);
+
+  it('GET /example.com with request cookie', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/echoheaders')
+      .set('cookie', 'a')
+      .set('cookie2', 'b')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expectJSON({
+        host: 'example.com',
+      }, done);
+  });
+
+  it('GET /example.com with unknown header', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/echoheaders')
+      .set('cookie', 'a')
+      .set('cookie2', 'b')
+      .set('cookie3', 'c')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expectJSON({
+        host: 'example.com',
+        cookie3: 'c',
+      }, done);
+  });
+});
+
+describe('httpProxyOptions.xfwd=false', function() {
+  before(function() {
+    cors_anywhere = createServer({
+      httpProxyOptions: {
+        xfwd: false
+      }
+    });
+    cors_anywhere_port = cors_anywhere.listen(0).address().port;
+  });
+  after(stopServer);
+
+  it('X-Forwarded-* headers should not be set', function(done) {
+    request(cors_anywhere)
+      .get('/example.com/echoheaders')
+      .set('test-include-xfwd', '')
+      .expect('Access-Control-Allow-Origin', '*')
+      .expectJSON({
+        host: 'example.com',
+      }, done);
+  });
+});

server/server.js

@@ -34,6 +34,17 @@ var port = 3000;
 var lists = {};
 var unique_ids = [];
 
+var host = process.env.PORT ? '0.0.0.0' : '127.0.0.1';
+ 
+var cors_proxy = require('cors-anywhere');
+
+cors_proxy.createServer({
+    requireHeader: ['origin', 'x-requested-with'],
+    removeHeaders: ['cookie', 'cookie2']
+}).listen(8080, host, function() {
+    console.log('Running CORS Anywhere on ' + host + ':' + 8080);
+});
+
 server.listen(port, function () {
   console.log('Server listening at port %d', port);
 });

static/js/youtube.js

@@ -142,7 +142,7 @@ var Youtube = {
     			//$("body").css("background-color", colorThief.getColor(img));
     		};
     		img.crossOrigin = 'Anonymous';
-    		img.src = 'https://cors-anywhere.herokuapp.com/http://img.youtube.com/vi/'+id+'/mqdefault.jpg';
+    		img.src = '//localhost:8080/http://img.youtube.com/vi/'+id+'/mqdefault.jpg';
     	}
     },