Understanding XMLHttpRequest over CORS (responseText)

by

For a “simple” HTTP verb like GET or POST, yes, the entire page is fetched, and then the browser decides whether JavaScript gets to use the contents or not. The server doesn’t need to know where the requests comes from; it is the browser’s job to inspect the reply from the server and determine if JS is permitted to see the contents.

For a “non-simple” HTTP verb like PUT or DELETE, the browser issues a “preflight request” using an OPTIONS request. In that case, the browser first checks to see if the domain and the verb are supported, by checking for Access-Control-Allow-Origin and Access-Control-Allow-Methods, respectively. (See the “Handling a Not-So-Simple Request” on the CORS page of HTML5 Rocks for more information.) The preflight response also lists permissible non-simple headers, included in Access-Control-Allow-Headers.

This is because allowing a client to send a DELETE request to the server could be very bad, even if JavaScript never gets to see the cross-domain result — again, remember that the server is generally not under any obligation to verify that the request is coming from a legitimate domain (although it may do so using the Origin header from the request).

More Related Contents:

  1. “Origin null is not allowed by Access-Control-Allow-Origin” error for request made by application running from a file:// URL
  2. Origin is not allowed by Access-Control-Allow-Origin
  3. How to enable CORS in AngularJs
  4. Why does my http://localhost CORS origin not work?
  5. Origin null is not allowed by Access-Control-Allow-Origin
  6. enabling cross-origin resource sharing on IIS7
  7. No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘…’ is therefore not allowed access
  8. Why am I seeing an “origin is not allowed by Access-Control-Allow-Origin” error here? [duplicate]
  9. A CORS POST request works from plain JavaScript, but why not with jQuery?
  10. AngularJS: No “Access-Control-Allow-Origin” header is present on the requested resource [duplicate]
  11. Why am I seeing an “origin is not allowed by Access-Control-Allow-Origin” error here? [duplicate]
  12. Catching an Access-Control-Allow-Origin error in JavaScript
  13. CORS request not working in Safari
  14. How to Detect Cross Origin (CORS) Error vs. Other Types of Errors for XMLHttpRequest() in Javascript
  15. Microsoft Edge blocked cross-domain requests sent to IPs in same private network CIDR
  16. Send POST data using XMLHttpRequest
  17. How does JavaScript handle AJAX responses in the background?
  18. how to bypass Access-Control-Allow-Origin?
  19. Is it possible to trap CORS errors?
  20. How to upload a file using jQuery.ajax and FormData
  21. No ‘Access-Control-Allow-Origin’ header with Microsoft Online Auth
  22. Uncaught (in promise) TypeError: Failed to fetch and Cors error
  23. SCRIPT5: Access is denied in IE9 on xmlhttprequest
  24. Javascript: Overriding XMLHttpRequest.open()
  25. CORS error for application running from file:// scheme
  26. CORS and Google Maps Places Autocomplete API calls [duplicate]
  27. How do I send an HTTP request from a Chrome extension?
  28. XmlHttpRequest onprogress interval
  29. socket.io, ‘Access-Control-Allow-Origin’ error
  30. Phantom JS synchronous AJAX request : NETWORK_ERR: XMLHttpRequest Exception 101

Leave a Comment