* Julian Reschke wrote:
Peter Michaux wrote:
I think all XMLHttpRequest headers should be specified as blank when
the object is created. Then the JavaScript can add any headers it
needs to add. If, when the call to send() occurs, some essential
header(s) is missing the XHMLHttpRequest object
Anne van Kesteren wrote:
On Mon, 12 May 2008 17:24:16 +0200, Julian Reschke
[EMAIL PROTECTED] wrote:
Well, we just heard from people complaining about XHR implementations
pre-filling request headers, and thus causing clients to create broken
content-type headers (because of the append
On Thu, 17 Apr 2008 01:49:44 +0200, Peter Michaux [EMAIL PROTECTED]
wrote:
The XMLHttpRequest spec says The setRequestHeader() method appends a
value if the HTTP header given as argument is already part of the list
of request headers.
This is fine but what is a problem is whether or not a new
On Thu, 17 Apr 2008 15:31:37 +0200, Julian Reschke [EMAIL PROTECTED]
wrote:
The whole append semantics is problematic as long as the user can't
find out what the current value is.
IMHO we need either removeRequestHeader(), getRequestHeader(), or both.
Yes, you have already stated this
Anne van Kesteren wrote:
On Thu, 17 Apr 2008 15:31:37 +0200, Julian Reschke
[EMAIL PROTECTED] wrote:
The whole append semantics is problematic as long as the user can't
find out what the current value is.
IMHO we need either removeRequestHeader(), getRequestHeader(), or both.
Yes, you have
Sunava Dutta wrote:
IMHO we need either removeRequestHeader(), getRequestHeader(), or both.
GetRequestHeader could pose a security risk, because you could then
GetRequestHeader (Cookie) and steal HTTPOnly cookies.
Sure. It would need to be done correctly. That doesn't change the fact
that
Peter Michaux wrote:
The XMLHttpRequest spec says The setRequestHeader() method appends a
value if the HTTP header given as argument is already part of the list
of request headers.
This is fine but what is a problem is whether or not a new
XHMHttpRequest object has any default headers. I was
The XMLHttpRequest spec says The setRequestHeader() method appends a
value if the HTTP header given as argument is already part of the list
of request headers.
This is fine but what is a problem is whether or not a new
XHMHttpRequest object has any default headers. I was trying to use the
Accept
