3 ms·

Unless I'm missing something, headers here can also be set to appear as another request type. (And to be clear - I could be missing something. Does the browser

• gruez 4y ago
  >Does the browser allow replacing e.g Sec-* headers on XHR requests? Probably not, according to this snippet from MDN > With this information a server can implement a resource isolation policy, allowing external sites to request only those resources that are intended for sharing, and that are used appropriately. This approach can help mitigate common cross-site web vulnerabilities such as CSRF, Cross-site Script Inclusion('XSSI'), timing attacks, and cross-origin information leaks. https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header https://developer.mozilla.org/en-US/docs/Glossary/Fetch_meta... being able to override it kills the whole point of the headers.