X-Requested-With header is incorrect in FetchHttpClient

[val1984]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

FetchHttpClient.ts sets X-Requested-With header to XMLHttpRequest which makes it harder than needed to know which HTTP client was used by @microsoft/signalr JS library.

Expected Behavior

X-Requested-With header should be set to Fetch as it was in the initial implementation.

Steps To Reproduce

Make use of @microsoft/signalr JS library and check the headers sent by the lib when calling the negotiate route.

Exceptions (if any)

No response

.NET Version

No response

Anything else?

@microsoft/signalr: ^6.0.9

[BrennanConroy]

This header is intentionally set so that Cookie authentication will avoid redirecting to a login page, if it actually did the redirect, it would result in an ugly, hard to diagnose error on the client side.

aspnetcore/src/Security/Authentication/Cookies/src/CookieAuthenticationEvents.cs

Lines 94 to 96 in 3ea008c

	if (IsAjaxRequest(context.Request))
	{
	context.Response.Headers.Location = context.RedirectUri;

aspnetcore/src/Security/Authentication/Cookies/src/CookieAuthenticationEvents.cs

Lines 105 to 108 in 3ea008c

	private static bool IsAjaxRequest(HttpRequest request)
	{
	return string.Equals(request.Query[HeaderNames.XRequestedWith], "XMLHttpRequest", StringComparison.Ordinal) ||
	string.Equals(request.Headers.XRequestedWith, "XMLHttpRequest", StringComparison.Ordinal);

This behavior is customizable by setting the header yourself when creating the connection.

new signalR.HubConnectionBuilder()
    .withUrl("/chathub", { headers: { "X-Requested-With": "Fetch" } })
    .build();

[val1984]

What is the point of it if it's always set to "XMLHttpRequest", even when the FetchHttpClient is used?

Shouldn't CookieAuthenticationEvents.cs be modified to also accept "Fetch"?

[BrennanConroy]

which HTTP client was used by @microsoft/signalr JS library

Why do you need to know this information?

This behavior is customizable by setting the header yourself when creating the connection.

Is this customization not usable for your scenario?

Shouldn't CookieAuthenticationEvents.cs be modified to also accept "Fetch"?

No. Using "Fetch" as the header value is not a common pattern, whereas XMLHttpRequest is a very well known pattern that has been used for years across multiple technology stacks.

[ghost]

Hi @val1984. We have added the "Needs: Author Feedback" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

[ghost]

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment. If it is closed, feel free to comment when you are able to provide the additional information and we will re-investigate.

See our Issue Management Policies for more information.