XMLHttpRequest: setRequestHeader() method

Baseline Widely available

This feature is well established and works across many devices and browser versions. It’s been available across browsers since ⁨July 2015⁩.

Note: This feature is available inWeb Workers, except forService Workers.

TheXMLHttpRequest methodsetRequestHeader() sets the value of an HTTP request header.When usingsetRequestHeader(), you must call it after callingopen(), but before callingsend().If this method is called several times with the same header, the values are merged into one single request header.

Each time you callsetRequestHeader() after the first time you call it, the specified text is appended to the end of the existing header's content.

If noAccept header has been set using this, anAccept header with the type"*/*" is sent with the request whensend() is called.

For security reasons, there are severalforbidden request headers whose values are controlled by the user agent. Any attempt to set a value for one of those headers from frontend JavaScript code will be ignored without warning or error.

In addition, theAuthorization HTTP header may be added to a request, but will be removed if the request is redirected cross-origin.

Note:For your custom fields, you may encounter a "not allowed by Access-Control-Allow-Headers in preflight response" exception when you send requests across domains.In this situation, you need to set up theAccess-Control-Allow-Headers in your response header at server side.