drop X-Requested-With header from the default $http config

[IgorMinar]

X-Requested-With causes CORS requests to trigger preflight checks which complicates things for many simple things.

The header is not very useful except for certain edge-cases (e.g. I think that Rails uses the header to switch full page and page fragment rendering).

[IgorMinar]

better then completely dropping the header would be to send it only for same-domain requests. this will require moving the header from the default header config into a filter or something similar.

[IgorMinar]

unsurprisingly this is exactly what jquery does: https://github.com/jquery/jquery/blob/81c7b83d645d2f151e9e40f9f98cc4b70e81a62a/src/ajax/xhr.js#L84

[zvictor]

I agree, I was having the same problem and I had to change server headers.

[AshD]

+1

[vitch]

+1

[olragon]

+1

[escalant3]

+1

[rkirov]

I had a chat with Misko about this. It might be easier to completely remove this header and let people add it on demand. Otherwise we would need to keep two sets of default headers - headers.common and headers.commonCrossDomain, which would add more complexity and documentation.

[IgorMinar]

Let's just remove it as it makes the documentation and expectations easier to manage. Adding the header to the defaults is trivial.

[rkirov]

For the record, here is the snippet to reenable the previous behavior that Igor mentioned:

myModule.config(function($httpProvider) {
  $httpProvider.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';
});

[taralx]

+1

[tchatel]

Since a few days, with this header all CORS requests to Google APIs fail, causing an "Origin [...] is not allowed by Access-Control-Allow-Origin" error.

You can see the error in Vojta's Task Manager : http://task-manager-angular.appspot.com/app/index.html
It it does no longer work, as any AngularJS application making $http requests to Google APIs.

[celmaun]

+1 to only sending for same-domain requests. -1 to removing it.