AJAX

XMLHttpRequest object (Internet Explorer) Represents an XML request using HTTP.

Members The XMLHttpRequest object has these types of members: Events. Using XMLHttpRequest - Document Object Model (DOM) In this guide, we'll take a look at how to use XMLHttpRequest to issue HTTP requests in order to exchange data between the web site and a server.

Examples of both common and more obscure use cases for XMLHttpRequest are included. To send an HTTP request, create an XMLHttpRequest object, open a URL, and send the request. After the transaction completes, the object will contain useful information such as the response body and the HTTP status of the result. function reqListener () { console.log(this.responseText);} var oReq = new XMLHttpRequest(); oReq.addEventListener("load", reqListener); oReq.open("GET", " oReq.send(); Types of requests A request made via XMLHttpRequest can fetch the data in one of two ways, asynchronously or synchronously. Note: Starting with Gecko 30.0 (Firefox 30.0 / Thunderbird 30.0 / SeaMonkey 2.27), synchronous requests on the main thread have been deprecated due to the negative effects to the user experience.

Handling responses Handling binary data Monitoring progress ? XMLHttpRequest - Document Object Model (DOM) Use XMLHttpRequest (XHR) objects to interact with servers.

You can retrieve data from a URL without having to do a full page refresh. This enables a Web page to update just part of a page without disrupting what the user is doing. XMLHttpRequest is used heavily in Ajax programming. Despite its name, XMLHttpRequest can be used to retrieve any type of data, not just XML, and it supports protocols other than HTTP (including file and ftp). If your communication needs involve receiving event or message data from the server, consider using server-sent events through the EventSource interface. Constructor. XMLHttpRequest. Abstract The XMLHttpRequest specification defines an API that provides scripted client functionality for transferring data between a client and a server.

Status of this Document This section describes the status of this document at the time of its publication. Other documents may supersede this document. A list of current W3C publications and the latest revision of this technical report can be found in the W3C technical reports index at This document is published as a snapshot of the XMLHttpRequest Living Specification. If you wish to make comments regarding this document in a manner that is tracked by the W3C, please submit them via using our public bug database, or please send comments to public-webapps@w3.org (archived) with [XHR] at the start of the subject line.

The W3C Web Applications Working Group is the W3C working group responsible for this specification's progress along the W3C Recommendation track. HTTP access control (CORS) - HTTP. A resource makes a cross-origin HTTP request when it requests a resource from a different domain than the one which the first resource itself serves.

For example, an HTML page served from makes an <img> src request for Many pages on the web today load resources like CSS stylesheets, images and scripts from separate domains. For security reasons, browsers restrict cross-origin HTTP requests initiated from within scripts. For example, XMLHttpRequest and Fetch follow the same-origin policy. Cross-origin resource sharing. Cross-origin resource sharing (CORS) is a mechanism that allows restricted resources (e.g. fonts, JavaScript, etc.) on a web page to be requested from another domain outside the domain from which the resource originated.[1] A web page may freely embed images, stylesheets, scripts, iframes, videos and some plugin content (such as Adobe Flash) from any other domain.

However embedded web fonts and AJAX (XMLHttpRequest) requests have traditionally been limited to accessing the same domain as the parent web page (as per the same-origin security policy). "Cross-domain" AJAX requests are forbidden by default because of their ability to perform advanced requests (POST, PUT, DELETE and other types of HTTP requests, along with specifying custom HTTP headers) that introduce many security issues as described in cross-site scripting. How CORS works[edit] The CORS standard describes new HTTP headers which provide browsers and servers a way to request remote URLs only when they have permission. [edit] Cross-Origin Resource Sharing. Abstract This document defines a mechanism to enable client-side cross-origin requests.

Specifications that enable an API to make cross-origin requests to resources can use the algorithms defined by this specification. If such an API is used on resources, a resource on can opt in using the mechanism described by this specification (e.g., specifying Access-Control-Allow-Origin: as response header), which would allow that resource to be fetched cross-origin from Status of this Document This section describes the status of this document at the time of its publication. This document has been reviewed by W3C Members, by software developers, and by other W3C groups and interested parties, and is endorsed by the Director as a W3C Recommendation. This W3C Recommendation of CORS was produced jointly by the Web Applications (WebApps) and Web Application Security (WebAppSec) Working Groups, and published by the WebAppSec Working Group. Table of Contents 1 Introduction.