Custom headers impossible with XDomainRequest (IE8/9)

[nicolas-rempulski]

XDomainRequest objects cannot be set with custom headers (especially content-type). XDomainRequest.contentType is a read-only field (getter) :

http://msdn.microsoft.com/en-us/library/ie/cc288060(v=vs.85).aspx

The reason behind this is security, as stated in this msdn blog entry (point 4) :

http://blogs.msdn.com/b/ieinternals/archive/2010/05/13/xdomainrequest-restrictions-limitations-and-workarounds.aspx.

But on xhr.js [getXMLHttpRequest] function, the decision between XDomainRequest and XmlHttpRequest do not check if the request parameters specify headers. So if inParam.headers is set with some custom headers, in a XDomain scenario, [request] function would try to set them with :

xhr.setRequestHeader(key, inParams.headers[key]);

But the function setRequestHeader is not defined for XDomainRequest objects.

Thus I propose to patch xhr.js in two points :

1)Passing all request params to [getXMLHttpRequest] to allow a fallback to XMLHttpRequest object in case inParams.headers are set.

2)Checking the definition of xhr.setRequestHeader before setting header, thus preventing an exception if the xhr variable is a XDomainRequest.

Enyo-DCO-1.0-Signed-off-by: Nicolas Rempulski nicolas.rempulski@ubidreams.com

Edit : sorry about this slip, yet I read the contribute page !

[unwiredben]

This looks good -- I just need a Enyo DCO in order to take the pull. See http://enyojs.com/community/contribute/ -- just provide it as an edit on the PR description.

[unwiredben]

Since this doesn't merge directly anymore, I'm just incorporating the idea into my own code change and closing this pull request.