Geek Answers Handbook

Etag header not returning from jQuery.ajax () cross-origin XHR

Why Etag n't the Etag header return jqXHR.getAllResponseHeaders() in the following minimal example?

Run with: node etag-server.js (then visit http://localhost:8080/ )

ETag-server.js

 var fs = require('fs'), http = require('http'); var webServer = http.createServer(function (request, response) { response.writeHead(200, {"Content-Type": "text/html"}); response.end(fs.readFileSync('frontend.html')); }); var apiServer = http.createServer(function (request, response) { response.writeHead(200, { 'Access-Control-Allow-Origin': 'http://localhost:8080', 'Cache-Control': 'no-cache', 'Content-Type': 'application/json; charset=utf-8', 'Etag': 123, 'Expires': -1, 'Pragma': 'no-cache' }); response.end(JSON.stringify({ data: [1, 2, 3] })); }); webServer.listen(8080); apiServer.listen(8081);

frontend.html

 <!DOCTYPE html> <html> <head> <title>Etag header not returned from jQuery.ajax() cross-origin XHR</title> <script src="//code.jquery.com/jquery-1.10.2.min.js" type="text/javascript"></script> <script type="text/javascript"> $(document).ready(function () { $.ajax('//localhost:8081/') .done(function (data, textStatus, jqXHR) { $('pre').text(jqXHR.getAllResponseHeaders()); }) .fail(function (jqXHR, textStatus, errorThrown) { $('pre').text(textStatus); }); }); </script> </head> <body> <pre></pre> </body> </html>

Page output

 Cache-Control: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Pragma: no-cache

Where does Etag ? They are sent to the browser:

 HTTP/1.1 200 OK Access-Control-Allow-Origin: http://localhost:8080 Cache-Control: no-cache Content-Type: application/json; charset=utf-8 Etag: 123 Expires: -1 Pragma: no-cache Date: Sat, 25 Jan 2014 02:20:47 GMT Connection: keep-alive Transfer-Encoding: chunked

(as reported by Firebug)

+3
source share
1 answer

The ETag header that appears in cross-origin responses will not be available for client code unless the server includes the Access-Control-Expose-Headers header in its response with the value “ETag”. This applies to any "difficult" response headers.

From the CORS specification :

7.1.1 Cross-origin request response processing User agents must filter out all response headers other than those that are simple response headers, or the field name does not match the ASCII value for one of the Access-Control-Expose Headers header values ​​(if any) before exposing the response headers to the APIs defined in the CORS API specifications.

Simple response headers are limited:

  • Cache control
  • Content language
  • Content type
  • Expires
  • Last-modified
  • Pragma

All other headers that the client should receive in response should be “open” through the response header mentioned above.

+17
source

More articles:


All Articles