Non-standard `X-Requested-With` should be opt-in not opt-out

[derekm]

X-Requested-With is a non-standard header that isn't called for by the XMLHttpRequest living standard.

This header should be presented only on an opt-in basis. Ajax requests should not come with this header by default.

[derekm]

Here is where it was decided to remove this erroneous header from Angular back in 2012: angular/angular.js#1004

[derekm]

A more recent take on this issue in Angular's issues: angular/angular.js#11008 (comment)

[derekm]

@benlesh -- This could be a breaking change for some people that are using the X-Requested-With anti-pattern in their server-side code... So this change should be called out very explicitly in the release notes. Thanks for the fix!

[derekm]

@benlesh -- Isn't the "BREAKING CHANGE" notice in your second commit stating things backwards? It will now execute a CORS request by default, it will no longer execute an X-Requested-With request by default.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.