Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>W3C has <a href="http://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader-method">this spec</a> about headers allowed by <code>setRequestHeader</code></p> <blockquote> <p>Terminate these steps if header is a case-insensitive match for one of the following headers:</p> <ul> <li>Accept-Charset </li> <li>Accept-Encoding </li> <li>Access-Control-Request-Headers</li> <li>Access-Control-Request-Method </li> <li>Connection </li> <li>Content-Length </li> <li>Cookie</li> <li>Cookie2 </li> <li>Content-Transfer-Encoding </li> <li>Date</li> <li>Expect</li> <li>Host </li> <li>Keep-Alive</li> <li>Origin</li> <li>Referer</li> <li>TE </li> <li>Trailer</li> <li>Transfer-Encoding </li> <li>Upgrade</li> <li>User-Agent </li> <li>Via</li> </ul> <p>… or if the start of header is a case-insensitive match for Proxy- or Sec- (including when header is just Proxy- or Sec-).</p> <p>The above headers are controlled by the user agent to let it control those aspects of transport. <strong>This guarantees data integrity to some extent.</strong> Header names starting with Sec- are not allowed to be set to allow new headers to be minted that are guaranteed not to come from XMLHttpRequest.</p> </blockquote> <p>Also you may consider:</p> <p>If header is not in the <a href="http://www.w3.org/TR/XMLHttpRequest/#author-request-headers">author-request-headers</a> list append header with its associated value to the list and terminate these steps.</p> <p>About browsers implementation, I've found this nice test: <a href="https://dvcs.w3.org/hg/webapps/diff/5814514eeba4/tests/XMLHttpRequest/setrequestheader-header-forbidden.htm">https://dvcs.w3.org/hg/webapps/diff/5814514eeba4/tests/XMLHttpRequest/setrequestheader-header-forbidden.htm</a> that you cant use to find current differences.</p> <p>For example, <strong>IE</strong> has this definition of security on headers:</p> <p><a href="http://msdn.microsoft.com/en-us/library/ms536752.aspx">IE</a>: Refer to <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html">RFC2616, Section 14</a>: Header Field Definitions for a general list of standard headers. The server is ultimately responsible for honoring the headers of the request. By far the most common request header is Content-Type, which is required by some XML Web services. </p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload