Rails core - Jul 2013 - CORS XHR requests with jQuery

This is a repost form this Github issue : 
https://github.com/rails/rails/issues/11380 

I would like to have your opinion about the following :

When sending an AJAX request, one expect `request.xhr?` to return `true`, 
but this is not true when using jQuery and CORS. This problem is caused by 
the fact jQuery decided to not automatically send `X_HTTP_REQUESTED_WITH` 
header for CORS requests (see. http://bugs.jquery.com/ticket/8423). 

I think every CORS requests should be considered as XHR requests. And I 
would advocate updating `action_dispatch/http/request.rb` 
`ActionDispatch::Request#xhr?` to return true for every CORS requests. This 
might be implemented by detecting presence of `Origin` header (and maybe 
checking `Host` and `https`).

Do you see any use-case where CORS requests would not be XHR requests or 
any other issue with this proposal ?

Thanks !

-- 
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Core" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to rubyonrails-core+unsubscribe@googlegroups.com.
To post to this group, send email to rubyonrails-core@googlegroups.com.
Visit this group at http://groups.google.com/group/rubyonrails-core.
For more options, visit https://groups.google.com/groups/opt_out.

I was going to ask if maybe this could be fixed by adding the requested-with
header for CORS requests in jquery-ujs. But after reading through the jquery
ticket, it sounds like they had a good reason to remove it (so that it
doesn''t cause unnecessary preflighted requests), which I agree with. So
yeah, this would be best handled on the server-side, if such a change were to be
implemented.

-- Steve Schwartz


On Tuesday, July 9, 2013 at 11:10 AM, Yvan BARTHÉLEMY wrote:
> This is a repost form this Github issue :
https://github.com/rails/rails/issues/11380
>  
> I would like to have your opinion about the following :
>  
> When sending an AJAX request, one expect `request.xhr?` to return `true`,
but this is not true when using jQuery and CORS. This problem is caused by the
fact jQuery decided to not automatically send `X_HTTP_REQUESTED_WITH` header for
CORS requests (see. http://bugs.jquery.com/ticket/8423).
>  
> I think every CORS requests should be considered as XHR requests. And I
would advocate updating `action_dispatch/http/request.rb`
`ActionDispatch::Request#xhr?` to return true for every CORS requests. This
might be implemented by detecting presence of `Origin` header (and maybe
checking `Host` and `https`).
>  
> Do you see any use-case where CORS requests would not be XHR requests or
any other issue with this proposal ?
>  
> Thanks !  
>  
> --  
> You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Core" group.
> To unsubscribe from this group and stop receiving emails from it, send an
email to rubyonrails-core+unsubscribe@googlegroups.com
(mailto:rubyonrails-core+unsubscribe@googlegroups.com).
> To post to this group, send email to rubyonrails-core@googlegroups.com
(mailto:rubyonrails-core@googlegroups.com).
> Visit this group at http://groups.google.com/group/rubyonrails-core.
> For more options, visit https://groups.google.com/groups/opt_out.
>   
>   
-- 
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Core" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to rubyonrails-core+unsubscribe@googlegroups.com.
To post to this group, send email to rubyonrails-core@googlegroups.com.
Visit this group at http://groups.google.com/group/rubyonrails-core.
For more options, visit https://groups.google.com/groups/opt_out.