feat(ajax): default to opting into CORS (#3442)

BREAKING CHANGE: will no longer execute a CORS request by default, you must opt-in with the `crossDomain` flag in the config. closes #3273
ReactiveX · Mar 16, 2018 · aa3bf57 · aa3bf57
1 parent deca8f8
commit aa3bf57
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 9 deletions.
diff --git a/spec/observables/dom/ajax-spec.ts b/spec/observables/dom/ajax-spec.ts
@@ -50,7 +50,8 @@ describe('Observable.ajax', () => {
 
     const obj: Rx.AjaxRequest = {
       url: '/',
-      method: ''
+      method: '',
+      crossDomain: false,
     };
 
     Rx.Observable.ajax(obj).subscribe();
@@ -132,7 +133,21 @@ describe('Observable.ajax', () => {
       'Content-Type': 'kenny/loggins',
       'Fly-Into-The': 'Dangah Zone!',
       'Take-A-Ride-Into-The': 'Danger ZoooOoone!',
-      'X-Requested-With': 'XMLHttpRequest'
+    });
+  });
+
+  it('should set the X-Requested-With if crossDomain is false', () => {
+    Rx.Observable.ajax({
+      url: '/test/monkey',
+      method: 'GET',
+      crossDomain: false,
+    })
+    .subscribe();
+
+    const request = MockXMLHttpRequest.mostRecent;
+
+    expect(request.requestHeaders).to.deep.equal({
+      'X-Requested-With': 'XMLHttpRequest',
     });
   });
 
@@ -433,7 +448,6 @@ describe('Observable.ajax', () => {
       expect(MockXMLHttpRequest.mostRecent.url).to.equal('/flibbertyJibbet');
       expect(MockXMLHttpRequest.mostRecent.data).to.deep.equal(body);
       expect(MockXMLHttpRequest.mostRecent.requestHeaders).to.deep.equal({
-        'X-Requested-With': 'XMLHttpRequest',
       });
     });
 
@@ -624,7 +638,6 @@ describe('Observable.ajax', () => {
       expect(request.method).to.equal('POST');
       expect(request.url).to.equal('/flibbertyJibbet');
       expect(request.requestHeaders).to.deep.equal({
-        'X-Requested-With': 'XMLHttpRequest',
         'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'
       });
 
@@ -657,7 +670,6 @@ describe('Observable.ajax', () => {
       expect(request.method).to.equal('POST');
       expect(request.url).to.equal('/flibbertyJibbet');
       expect(request.requestHeaders).to.deep.equal({
-        'X-Requested-With': 'XMLHttpRequest',
         'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'
       });
 
@@ -692,7 +704,6 @@ describe('Observable.ajax', () => {
       expect(request.method).to.equal('POST');
       expect(request.url).to.equal('/flibbertyJibbet');
       expect(request.requestHeaders).to.deep.equal({
-        'X-Requested-With': 'XMLHttpRequest',
         'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'
       });
 

diff --git a/src/internal/observable/dom/AjaxObservable.ts b/src/internal/observable/dom/AjaxObservable.ts
@@ -23,7 +23,7 @@ export interface AjaxRequest {
   responseType?: string;
 }
 
-function getCORSRequest(this: AjaxRequest): XMLHttpRequest {
+function getCORSRequest(): XMLHttpRequest {
   if (root.XMLHttpRequest) {
     return new root.XMLHttpRequest();
   } else if (!!root.XDomainRequest) {
@@ -155,9 +155,9 @@ export class AjaxObservable<T> extends Observable<T> {
     const request: AjaxRequest = {
       async: true,
       createXHR: function(this: AjaxRequest) {
-        return this.crossDomain ? getCORSRequest.call(this) : getXMLHttpRequest();
+        return this.crossDomain ? getCORSRequest() : getXMLHttpRequest();
       },
-      crossDomain: false,
+      crossDomain: true,
       withCredentials: false,
       headers: {},
       method: 'GET',