Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Chrome Extension: how to change origin in AJAX request header?

I'm trying to manually set an origin in an ajax request header. In my background.js, I have this

var ajaxResponse;
$.ajax({
    type:'POST',
    url:'www.somewebsite.com/login/login.asp',
    headers:{
            'origin': 'https://www.somewebsite.com'
    },
    success: function(response){
        ajaxResponse = response;
    }
});

As you can see, the origin is changed. But when this Chrome extension get executed, the origin gets override to chrome-extension://iphajdjhoofhlpldiilkujgommcolacc and the console gives error 'Refused to set unsafe header "origin"'

I've followed Chrome API (http://developer.chrome.com/extensions/xhr.html), and already set the permission as follows

"permissions": [
     "https://www.somewebsite.com/*"
 ],

Does anyone know how to properly set the origin in header? Thanks!

like image 847
Maria Avatar asked Jan 01 '14 00:01

Maria


People also ask

Can I change origin in request header?

You cannot change the Origin header the browser sends when your JavaScript asks it to make an HTTP request. (Firefox, at least, will ignore attempts to set it). There isn't any point in changing it anyway.

How do I get a header from ajax request?

To add a custom header to an individual request then just add the headers property: // Request with custom header $. ajax({ url: 'edureka/co', headers: { 'custom-header': 'some value' } }); To add a default header to every request then use $.

What is request header origin?

The Origin request header indicates the origin (scheme, hostname, and port) that caused the request. For example, if a user agent needs to request resources included in a page, or fetched by scripts that it executes, then the origin of the page may be included in the request. Header type. Request header.


1 Answers

You probably misinterpreted the docs:
the extension can request access to remote servers outside of its origin

This means that the extension can send the request to the remote servers (i.e. the browser itself will not block the request as would happen with a normal web-page's JS).
This does not mean that the extension will be allowed to send arbitrary headers along with the request nor that the remote server will respond to the request.


So, if the remote server, requires a specific value for the Origin header, then there is nothing you can do, since according to the specs you are not allowed to set the Origin header (and this limitation also holds for extensions).

like image 59
gkalpak Avatar answered Oct 05 '22 23:10

gkalpak