onXhrSend

[kriszyp]

Add a listener for XHR calls. This would enable devs to add certain headers uniformly for all XHR calls (without having to modify the call-site code). The following are some proposed usages:

1. Adding an explicit authentication/validation token for each XHR request to prevent CSRF attacks. This is also known as double submitting when you use a cookie value as the validation token.
2. Adding a client id to XHR requests. This can be used to create a session for maintaining state information that will not have cross-tab interference.
3. Adding a sequence id to XHR requests. This provides a mechanism for deterministic message ordering (HTTP is not deterministic).
4. Add information about transactional processing. The dojo.data save function has a strong transactional feel to it, and the JsonRestStore? can transmit the opening/committing of transactions with headers without altering the data.

I will include a dojox.rpc.Client that includes provides #2 and #3.

[James Burke]

It seems like you can get the same behavior today by attaching to dojo.xhr (new for Dojo 1.1). All dojo.xhr* methods delegate to dojo.xhr for doing the calls. Is that sufficient?

[kriszyp]

Replying to jburke:

It seems like you can get the same behavior today by attaching to dojo.xhr (new for Dojo 1.1). All dojo.xhr* methods delegate to dojo.xhr for doing the calls. Is that sufficient?

That would be great, but rawXhrPut and rawXhrPost do not go through dojo.xhr. Could these two functions be modified to go through dojo.xhr? I would be perfectly happy with that.

[James Burke]

Ah, right. I forgot about those. OK, I'll see what I can do: either convert the raw calls to go through dojo.xhr or look at applying the patch.

[kriszyp]

Replying to jburke:

Ah, right. I forgot about those. OK, I'll see what I can do: either convert the raw calls to go through dojo.xhr or look at applying the patch.

Yeah, it seems like you need a way to pass the content entity (postData or putData) into dojo.xhr. Maybe in dojo.xhr:

dfd.ioArgs.query = args.putData

args.postData

dfd.ioArgs.query;

Then dojo.xhr could be called from those two functions.

[kriszyp]

XHR patch

[kriszyp]

I attached a patch for what seems a reasonable approach for making all the XHR calls (including rawXhrPut and rawXhrPost) go through dojo.xhr. I think I reduced the size xhr.js somewhat as well.

[James Burke]

(In [13530]) Refs #6525: hasBody comes from the dojo.xhr call args.

[James Burke]

(In [13531]) Fixes #6525: all xhr calls go through dojo.xhr now. Thanks to Kris Zyp for the patch. I applied it with a slight mod to the postData and putData detection. Nice patch that reduces the code footprint, thanks Kris! Also fixed an incorrect test.