feat(ajax): default to opting into CORS (#3442)

BREAKING CHANGE: will no longer execute a CORS request by default, you must opt-in with the `crossDomain` flag in the config. closes #3273
ReactiveX · Mar 16, 2018 · aa3bf57 · aa3bf57
1 parent deca8f8
commit aa3bf57
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 9 deletions.
diff --git a/spec/observables/dom/ajax-spec.ts b/spec/observables/dom/ajax-spec.ts
@@ -50,7 +50,8 @@ describe('Observable.ajax', () => {
 
  const obj: Rx.AjaxRequest = {
  url: '/',
- method: ''
+ method: '',
+ crossDomain: false,
  };
 
  Rx.Observable.ajax(obj).subscribe();
@@ -132,7 +133,21 @@ describe('Observable.ajax', () => {
  'Content-Type': 'kenny/loggins',
  'Fly-Into-The': 'Dangah Zone!',
  'Take-A-Ride-Into-The': 'Danger ZoooOoone!',
- 'X-Requested-With': 'XMLHttpRequest'
+ });
+ });
+
+ it('should set the X-Requested-With if crossDomain is false', () => {
+ Rx.Observable.ajax({
+ url: '/test/monkey',
+ method: 'GET',
+ crossDomain: false,
+ })
+ .subscribe();
+
+ const request = MockXMLHttpRequest.mostRecent;
+
+ expect(request.requestHeaders).to.deep.equal({
+ 'X-Requested-With': 'XMLHttpRequest',
  });
  });
 
@@ -433,7 +448,6 @@ describe('Observable.ajax', () => {
  expect(MockXMLHttpRequest.mostRecent.url).to.equal('/flibbertyJibbet');
  expect(MockXMLHttpRequest.mostRecent.data).to.deep.equal(body);
  expect(MockXMLHttpRequest.mostRecent.requestHeaders).to.deep.equal({
- 'X-Requested-With': 'XMLHttpRequest',
  });
  });
 
@@ -624,7 +638,6 @@ describe('Observable.ajax', () => {
  expect(request.method).to.equal('POST');
  expect(request.url).to.equal('/flibbertyJibbet');
  expect(request.requestHeaders).to.deep.equal({
- 'X-Requested-With': 'XMLHttpRequest',
  'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'
  });
 
@@ -657,7 +670,6 @@ describe('Observable.ajax', () => {
  expect(request.method).to.equal('POST');
  expect(request.url).to.equal('/flibbertyJibbet');
  expect(request.requestHeaders).to.deep.equal({
- 'X-Requested-With': 'XMLHttpRequest',
  'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'
  });
 
@@ -692,7 +704,6 @@ describe('Observable.ajax', () => {
  expect(request.method).to.equal('POST');
  expect(request.url).to.equal('/flibbertyJibbet');
  expect(request.requestHeaders).to.deep.equal({
- 'X-Requested-With': 'XMLHttpRequest',
  'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'
  });
 

diff --git a/src/internal/observable/dom/AjaxObservable.ts b/src/internal/observable/dom/AjaxObservable.ts
@@ -23,7 +23,7 @@ export interface AjaxRequest {
  responseType?: string;
 }
 
-function getCORSRequest(this: AjaxRequest): XMLHttpRequest {
+function getCORSRequest(): XMLHttpRequest {
  if (root.XMLHttpRequest) {
  return new root.XMLHttpRequest();
  } else if (!!root.XDomainRequest) {
@@ -155,9 +155,9 @@ export class AjaxObservable<T> extends Observable<T> {
  const request: AjaxRequest = {
  async: true,
  createXHR: function(this: AjaxRequest) {
- return this.crossDomain ? getCORSRequest.call(this) : getXMLHttpRequest();
+ return this.crossDomain ? getCORSRequest() : getXMLHttpRequest();
  },
- crossDomain: false,
+ crossDomain: true,
  withCredentials: false,
  headers: {},
  method: 'GET',