Is there any way to remove Ajax headers set by setRequestHeader()?

Question

I’m writing a JS script that lives within a system which is now adding a custom XID header to all Ajax requests via jqXHR.setRequestHeader() in a function registered with jQuery.ajaxPrefilter().

In my script, I need to make an Ajax request to a third party site, whose Access-Control-Allow-Headers is not set up to allow this custom XID header.

It seems I have 3 options:

1. Find a way to remove that XID header in $.ajax()’s beforeSend function, which I have confirmed gets called after the ajaxPrefilter() function.
2. Forgo using $.ajax() entirely and just write the Ajax stuff myself.
3. Have $.ajax() point to the system’s backend which does accept the custom XID header, and perform the request to the third party site via cURL.

Option #1 is preferred, if there’s a simple way to do it, since it will be the cleanest and fastest route. Just can’t figure out how.

I have tried overriding it like this, but it didn’t work:

beforeSend: function(jqXHR, settings) {     jqXHR.setRequestHeader('custom-xid-header', null); } 

Any ideas?

Answer 1

I realize this is an old thread, but it's still a problem! Hope the following will help resolve it for someone else as it has for us.

Setting a header to null/undefined/"" after it's been set does not remove it, it sends the header still but with either no value or "undefined" or "null". This is probably never what you want, and in our case, totally screws SSO when it's the Authorization header.

The solution we came up with relies on a mix of @marlar's suggestion (thanks) and another deficiency of jQuery: You can only have ONE beforeSend() hook, and any new hook replaces the previous one. It seems that this is also true if you supply a beforeSend() in a specific $.ajax() request - it will override any default one in $.ajaxSetup(). By doing so, you prevent the default hook from setting the header. (It's not 100% ideal because there may be other things done in the default beforeSend() that will then not happen, but hey).

So this copes with both static and dynamically set headers for a specific request:

if($.ajaxSettings && $.ajaxSettings.headers) {     delete $.ajaxSettings.headers.Authorization; } $.ajax({     beforeSend: function() {}, // no op     // ... }); 

You can't do the same for prefilter(), but I think beforeSend() is the far more common way of doing this anyway.