Detect xmlhttprequest call?!

Hello,

In the current application we have several httpmodules to process pages,
and we have several pages with calls directly through the XMLHttpRequest.
Now the requiremens is to detect the calls through the XMLHttpRequest and
apply addional actions in httpmodule for these types of call.

Because they dont use ASP.NET AJAX for this I cant use ScriptManager.IsInAsyncPostBack.
Everything what comes into my my how to catch these calls is check CurrentContext.Request.ContentType
for the string entry which is set like
request.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

before making XMLHttpRequest call. If !(string.IsNullOrEmpty(CurrentContext.Request.ContentType))
then we have XMLHttpRequest call.

I wonder if there are others way to check if call made via XMLHttpRequest?!

---
WBR,
Michael Nemtsev [Microsoft MVP] :: blog: http://spaces.live.com/laflour

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

mily242
Fri Jul 25 12:30:11 CDT 2008

Hi Michael,

Use Headers collection to identify request comes from a cetrain source.
That's the way Microsoft AJAX does it:
Headers collection:

[0] "Cache-Control" string
[1] "Connection" string
[2] "Content-Length" string
[3] "Content-Type" string
[4] "Accept" string
[5] "Accept-Encoding" string
[6] "Accept-Language" string
[7] "Host" string
[8] "Referer" string
[9] "User-Agent" string
[10] "x-microsoftajax" string <-- AJAX
because you are in control what you put into headers when issueing request
through XMLHttpRequest.

HTH
--
Milosz


"Michael Nemtsev [MVP]" wrote:

> Hello,
>
> In the current application we have several httpmodules to process pages,
> and we have several pages with calls directly through the XMLHttpRequest.
> Now the requiremens is to detect the calls through the XMLHttpRequest and
> apply addional actions in httpmodule for these types of call.
>
> Because they dont use ASP.NET AJAX for this I cant use ScriptManager.IsInAsyncPostBack.
> Everything what comes into my my how to catch these calls is check CurrentContext.Request.ContentType
> for the string entry which is set like
> request.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
>
> before making XMLHttpRequest call. If !(string.IsNullOrEmpty(CurrentContext.Request.ContentType))
> then we have XMLHttpRequest call.
>
> I wonder if there are others way to check if call made via XMLHttpRequest?!
>
> ---
> WBR,
> Michael Nemtsev [Microsoft MVP] :: blog: http://spaces.live.com/laflour
>
> "The greatest danger for most of us is not that our aim is too high and we
> miss it, but that it is too low and we reach it" (c) Michelangelo
>
>
>

Anthony
Sat Jul 26 04:17:13 CDT 2008

"Michael Nemtsev [MVP]" <nemtsev@msn.com> wrote in message
news:900895ec592018cabcd91c37a570@msnews.microsoft.com...
> Hello,
>
> In the current application we have several httpmodules to process pages,
> and we have several pages with calls directly through the XMLHttpRequest.
> Now the requiremens is to detect the calls through the XMLHttpRequest and
> apply addional actions in httpmodule for these types of call.
>
> Because they dont use ASP.NET AJAX for this I cant use
ScriptManager.IsInAsyncPostBack.
> Everything what comes into my my how to catch these calls is check
CurrentContext.Request.ContentType
> for the string entry which is set like
> request.setRequestHeader("Content-Type",
"application/x-www-form-urlencoded");
>
> before making XMLHttpRequest call. If
!(string.IsNullOrEmpty(CurrentContext.Request.ContentType))
> then we have XMLHttpRequest call.
>
> I wonder if there are others way to check if call made via
XMLHttpRequest?!
>

Its not possible to guarantee that the request is coming from XMLHttpRequest
unless there is some help from the client side. You are using a pattern of
usage which you hope is not also created in normal use of your app. Unless
you are prepared to change they way the clientside makes these requests
(and that assumes you have control over that) then your approach is probably
the only one available to you.


AJAX adds a header to specifically identify the request as has already been
pointed out.


--
Anthony Jones - MVP ASP/ASP.NET