Setting headers in XDomainRequest or ActiveXObject('Microsoft.XMLHTTP')

Question

I'm trying to do something like this (W3 compliant, DOM):

xhr.setRequestHeader( 'X-Requested-With', 'XMLHttpRequest' );

For ActiveXObject('Microsoft.XMLHTTP') and XDomainRequest (IE8). I'm having no such luck finding it anywhere in microsoft documentation or even google. Any idea how I can achieve this?

Answer 1

Probably you read something about setting "X-Requested-With: XMLHttpRequest" and "Content-Type: application/json" headers in context of JSON hijacking (like in http://haacked.com/archive/2009/06/25/json-hijacking.aspx or http://weblogs.asp.net/mschwarz/archive/2007/04/07/json-hijacking-and-how-ajax-net-professional-ajaxpro-avoids-these-attacks.aspx).

A good news if you use jQuery on the client side: jQuery set "X-Requested-With: XMLHttpRequest" for you automatically inside of all ajax calls. The only exception is if jQuery.ajax find out that you destination url is definitively a local url. MicrososoftAjax.js do the same inside of Sys.Net.XMLHttpExecutor.executeRequest() function. The function Sys.Mvc.MvcHelpers._asyncRequest do the same thing (inside of MicrosoftMvcAjax.js).

So only it you decide to implement ajax requests on low level, what is really not a good idea, you have to set "X-Requested-With: XMLHttpRequest" in the header of you ajax request. In this case look at the code inside jquery-1.4.2.js, MicrosoftAjax.debug.js or MicrosoftMvcAjax.debug.js as examples.

Best regards

Answer 2

Referring to this post http://blogs.msdn.com/b/ieinternals/archive/2010/05/13/xdomainrequest-restrictions-limitations-and-workarounds.aspx See the point three 3. No custom headers may be added to the request

You cannot add custom headers to an XDR object. Hope this helps.