CODEWITHSUNDEEP
javascriptcross-domain
Ashwin
Ashwin

Reputation: 13547

Why is the browser not throwing an error when setting X-Requested-With header when calling another domain?

I am running my server on localhost. I tried sending a http request using fetch with cors mode set as no-cors. I sent the request to a random resource in google.com domain. This request had the X-Requested-With header set to some custom value, save "Foo". This request successfully went through and returned a 404 NOT FOUND http status code on the browser.

But I expectation was that the request should not have been sent at all and that the browser should have thrown an error instead because on the following headers are allowed to be set cross-domain

Accept
Accept-Language
Content-Language
Last-Event-ID
Content-Type

Was my expectation wrong?

Upvotes: 0

Views: 113

Answers (1)

Quentin
Quentin

Reputation: 943746

From the specification:

Otherwise, if the context object’s guard is "request-no-cors" and name/value is not a no-CORS-safelisted request-header, return.

Attempting to set X-Requested-With fails silently and the request is made without the header.

Upvotes: 1

Related Questions