Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Etag header not returned from jQuery.ajax() cross-origin XHR

Why is the Etag header not being returned by jqXHR.getAllResponseHeaders() in the following minimal example?

Run with: node etag-server.js (then visit http://localhost:8080/)

etag-server.js

var fs = require('fs'),
    http = require('http');

var webServer = http.createServer(function (request, response) {
    response.writeHead(200, {"Content-Type": "text/html"});
    response.end(fs.readFileSync('frontend.html'));
});

var apiServer = http.createServer(function (request, response) {
    response.writeHead(200, {
        'Access-Control-Allow-Origin': 'http://localhost:8080',
        'Cache-Control': 'no-cache',
        'Content-Type': 'application/json; charset=utf-8',
        'Etag': 123,
        'Expires': -1,
        'Pragma': 'no-cache'
    });
    response.end(JSON.stringify({ data: [1, 2, 3] }));
});

webServer.listen(8080);
apiServer.listen(8081);

frontend.html

<!DOCTYPE html>
<html>
<head>
  <title>Etag header not returned from jQuery.ajax() cross-origin XHR</title>
  <script src="//code.jquery.com/jquery-1.10.2.min.js" type="text/javascript"></script>
  <script type="text/javascript">
    $(document).ready(function () {
        $.ajax('//localhost:8081/')
        .done(function (data, textStatus, jqXHR) {
            $('pre').text(jqXHR.getAllResponseHeaders());
        })
        .fail(function (jqXHR, textStatus, errorThrown) { $('pre').text(textStatus); });
    });
  </script>
</head>
<body>
<pre></pre>
</body>
</html>

Page Output

Cache-Control: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Pragma: no-cache

Where'd the Etag go? They're being sent to the browser:

HTTP/1.1 200 OK
Access-Control-Allow-Origin: http://localhost:8080
Cache-Control: no-cache
Content-Type: application/json; charset=utf-8
Etag: 123
Expires: -1
Pragma: no-cache
Date: Sat, 25 Jan 2014 02:20:47 GMT
Connection: keep-alive
Transfer-Encoding: chunked

(as reported by Firebug)

like image 438
Michael Kropat Avatar asked Nov 29 '22 15:11

Michael Kropat


1 Answers

The ETag header present in cross-origin responses will not be accessible to client-side code unless the server includes an Access-Control-Expose-Headers header in its response, with a value of "ETag". This is true of any "non-simple" response headers.

From the CORS spec:

7.1.1 Handling a Response to a Cross-Origin Request User agents must filter out all response headers other than those that are a simple response header or of which the field name is an ASCII case-insensitive match for one of the values of the Access-Control-Expose-Headers headers (if any), before exposing response headers to APIs defined in CORS API specifications.

Simple response headers are limited to:

  1. Cache-Control
  2. Content-Language
  3. Content-Type
  4. Expires
  5. Last-Modified
  6. Pragma

All other headers that the client needs to access in the response must be "exposed" via the response header I mentioned above.

like image 71
Ray Nicholus Avatar answered Dec 05 '22 19:12

Ray Nicholus