Set a request header in JavaScript

Question

It seems that I am unable to change most request headers from JavaScript when making an AJAX call using XMLHttpRequest. Note that when request.setRequestHeader has to be called after request.open() in Gecko browsers (see http://ajaxpatterns.org/Talk:XMLHttpRequest_Call). When I set the Referer, it doesn't get set (I looked at the request headers sent using Firebug and Tamper Data). When I set User-Agent, it messed up the AJAX call completely. Setting Accept and Content-Type does work, however. Are we prevented from setting Referer and User-Agent in Firefox 3?

var request = new XMLHttpRequest(); var path="http://www.yahoo.com"; request.onreadystatechange=state_change;  request.open("GET", path, true); request.setRequestHeader("Referer", "http://www.google.com"); //request.setRequestHeader("User-Agent", "Mozilla/5.0"); request.setRequestHeader("Accept","text/plain"); request.setRequestHeader("Content-Type","text/plain");  request.send(null);     function state_change() { if (request.readyState==4)   {// 4 = "loaded"   if (request.status==200)     {// 200 = OK     // ...our code here...     alert('ok');     }   else     {     alert("Problem retrieving XML data");     }   } } 

Answer 1

W3C Spec on setrequestheader.

The brief points:

If the request header had already been set, then the new value MUST be concatenated to the existing value using a U+002C COMMA followed by a U+0020 SPACE for separation.

UAs MAY give the User-Agent header an initial value, but MUST allow authors to append values to it.

However - After searching through the framework XHR in jQuery they don't allow you to change the User-Agent or Referer headers. The closest thing:

// Set header so the called script knows that it's an XMLHttpRequest xhr.setRequestHeader("X-Requested-With", "XMLHttpRequest"); 

I'm leaning towards the opinion that what you want to do is being denied by a security policy in FF - if you want to pass some custom Referer type header you could always do:

xhr.setRequestHeader('X-Alt-Referer', 'http://www.google.com');