*** If interested in CORS, try this.
This is an annoying little error that I've seen some people mention and even ran into with JavaScript. Moreover, it appears only in Webkit based browsers. So what's the problem? Basically a browser like Google Chrome will not change certain http headers in an
Now as for ways around this, you would need either an addon to modify this for you or use related command line arguments. For example, to change the
*[1] - http://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader-method
This is an annoying little error that I've seen some people mention and even ran into with JavaScript. Moreover, it appears only in Webkit based browsers. So what's the problem? Basically a browser like Google Chrome will not change certain http headers in an
XMLHttpRequest using setRequestHeader(). This is not a problem in Firefox or Opera from my testing so far. According to W3, it is actually the behavior they have as "standard" in their working draft. Headers they don't want you to overwrite are"Now as to where this could be a problem, for me at least, is when I am trying to spoof some headers and want to do so in a browser as apposed to writing a script or getting an addon to do so for me. However, there is a security risk it could open up called HTTP Request Smuggling. As to how one would pull it off, I think an XSS vulnerability would need to be there as well for this in JavaScript to do anything. Bottom line for the security of it on the design end, make sure you check your sources before you use things like external scripts. As for user-end security, just be careful what sites you go to and use some common sense when you can.
Or if the start of header is a case-insensitive match for Proxy- or Sec- (including when header is just Proxy- or Sec-)."[1]
- Accept-Charset
- Accept-Encoding
- Access-Control-Request-Headers
- Access-Control-Request-Method
- Connection
- Content-Length
- Cookie
- Cookie2
- Date
- DNT
- Expect
- Host
- Keep-Alive
- Origin
- Referer
- TE
- Trailer
- Transfer-Encoding
- Upgrade
- User-Agent
- Via
Now as for ways around this, you would need either an addon to modify this for you or use related command line arguments. For example, to change the
User-Agent header, you launch Chrome from your terminal with the option --user-agent="Some new UA string". As for an addon to do this, I do not know of any or if it is even possible, but if I find something I will update that here.*[1] - http://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader-method
How do you get Google Chrome to make a CORS request with xmlHttpRequest object then?
ReplyDeleteI poked around on Google to see if I could find some help, and I found a post saying Chrome has a limited "same origin policy" for versions previous to 13, but 13 and up allow CORS. Mozilla suggests checking for:
Deleteif("withCredentials" in request)
To determine if the browser supports CORS, and the rest seems to be handled in a normal, simple request.
So I think Google Chrome 13 and up set the necessary headers themselves if they are within these protected headers, probably why they are protected as well, some security measure of some sort.
My resources I checked were:
http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/
http://code.google.com/chrome/extensions/xhr.html
Hope that helps in some way and I'm not just giving you stuff you already know. If you find anything else about this, let me know.
Hello,
ReplyDeleteIs there a workaround for this issue ? Any updates on how to achieve setting headers ??? Eagerly waiting....
I want to be able to set "Connection" and "Kepp-alive" headers.
Thank you
A solution might be found in either my post about CORS in Chrome
Deletehttp://news.anarchy46.net/2013/02/chrome-cors.html
Or a more specific answer to your case might be found by looking into HTTP access-control headers.
If that doesn't help, let me know and I'll see if I can dig up any other information that might help.