CODEWITHSUNDEEP
ajaxxmlhttprequestcorscustom-headers
Muhammad Umer
Muhammad Umer

Reputation: 18097

Are preflight requests made for ajax call to same origin domain?

This answer states, that one way X-Requested-With header prevents CSRF attacks is that if server doesn't allow it then a modern browser wont allow javascript code to add this header. And if header is present server can be sure that request didn't originate from another page a user might have opened.

To my understanding the way browser determines whether a custom header is allowed or not in an ajax request is by making a preflight request. And then a server responds with header Access-Control-Allow-Headers. Which contains list of headers allowed for a request in question. So if servers returns an empty list then CORS ajax calls couldn't have xhr header present. Indicating different origin.

So my question is whether preflight request is triggered if origin is the same. Because if they are, then server would say dont add any header, and if browser doesn't then to server a request from its own origin would be indistinguishable from another origin.

Upvotes: 0

Views: 592

Answers (1)

Quentin
Quentin

Reputation: 943219

So my question is whether preflight request is triggered if origin is the same.

No, it isn't.

Because if they are, then server would say dont add any header, and if browser doesn't then to server a request from its own origin would be indistinguishable from another origin.

The browser not sending a preflight request doesn't stop the server from testing the actual request for a header and throwing an error if it isn't present.

Upvotes: 1

Related Questions