JavaScript set HTTP request header value and FireFox issue

Question

In order to prevent direct url access to download files on my website I use following HTTP header which is setted by the following JavaScript during the click on download url:

$('a.download').on('click', function(){
    $.ajax({
        url: '/ajax/preventDownload',
        headers: { 'x-rarity-download-header': 'download' }
    });
})

Server checks if this 'x-rarity-download-header' present in HTTP request and if no doesn't allow user to download file.

Right now this approach works not in the all browsers, for example it works in FireFox 50 and looks like doesn't work on some previous versions like 48. Also, this approach doesn't work in Safari browser.

What can be a reason of this and how to fix it ?

Did you get it to work with beforeSend or use a different method? — Daniel W.
– Daniel W., Commented Nov 28, 2016 at 15:13

Daniel W. · Accepted Answer · 2016-11-28 13:56:51Z

1

First, you should respect the spelling. It should be X-Rarity-Download-Header.

Some software do take this more serious than others and only allow standarized headers or custom headers set with uppercase X-.

Besides that, I suggest you to switch to a more common method like oauth2 tokens.

Or something way easier, like:

1. Visit the site
2. Set a cookie
3. Allow download.
4. If cookie is not set, don't allow to download.

You can also try beforeSend method from jQuery, which seems a little better place to add headers: http://api.jquery.com/jquery.ajax/

answered Nov 28, 2016 at 13:56

Daniel W.

32.6k15 gold badges99 silver badges155 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

JavaScript set HTTP request header value and FireFox issue

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related