search

yanatan16 / nanoajax

An ajax library you need a microscope to see
MIT License
247 stars 42 forks source link

Discussion about X-Requested-With header #21

Open Vinorcola opened 7 years ago

Vinorcola commented 7 years ago

Hello,

Is there particullar reason why the X-Requested-With header is set only is request has a body? (https://github.com/yanatan16/nanoajax/blob/master/index.js#L75)

Shouldn't the header be set for any non GET or HEAD request?

For example, if I'm making a DELETE request with no body, I think the header should be there... Currently, I have to add this header by hand.

I'm not very competent on that matter, so maybe I'm wrong... Please advise.

bobrosoft commented 7 years ago

I have another related issue: XMLHttpRequest cannot load **my_domain_here**. Request header field X-Requested-With is not allowed by Access-Control-Allow-Headers in preflight response.. I don't see any option in the code to exclude that header. Is it really needed?

voxpelli commented 7 years ago

X-Requested-With is an established practice for indicating that a request is an AJAX-request and has wide support among back-end frameworks and should be added to all requests (but as shown probably with a mechanism that makes it possible to opt-out from, but that @bobrosoft is a different issue than the main one here, so better to open a new issue where you just reference this one, else it may be lost in the conversation when the main issue has been dealt with)

bobrosoft commented 7 years ago

I know it's different, I said "related" :) We just faced it in comparison to Angular 2 Http service which not send that header so we hadn't that issues before, but now need to use nanoajax in one microlibrary. I will create issue and PR if have time later (if PRs merged here).