Can Javascript tell if page was result of a GET or POST?

Question

Possible Duplicate:
Client-side detection of HTTP request method

I'm working on Javascript that is injected on any page. The script is injected on servers that I'm not controlling. (Injection is done with an add-on or bookmarklet.)

The Javascript needs to know whether the page was loaded as the result of an HTTP GET or POST. The reason for this is that if the page was loaded with a GET, the URL is an identifier for the page that can be bookmarked, shared with others, etc. In case of a POST, I need to handle it differently.

Can this be done? I have found no way of accessing the request from Javascript, but perhaps there is some trick that I don't know of.

Solution 1

I think you can't.

Brendan Eich just confirmed that last night on his twitter, in a conversation with dhh.

Reproducing here:

@dhh: Is there any continued reason why JavaScript can't access HTTP headers in the browser outside of Ajax? And what's the historic reason?

@BrendanEich: @dhh @lostconvos no good reason -- I had no time in the old days (apart from document.cookie and navigator.userAgent), no one followed up.

@dhh: Could we just borrow the API from xhr: getResponseHeader() and getAllResponseHeaders()?

I suggest you follow both in case you are interested on this matter.

In the meantime, I think the best you can do is having two different javascripts - one for POST pages and another one for the rest. You give both to your providers and tell them how to use them. But yes, this involves cooperation from the servers.

Solution 2

It's not possible to directly retrieve the POST data of a webpage; Imagine that it's possible. Then, the sensitive data, submitted through a POST request can also be read, which is obviously not desired.

If you're writing an extension/userscript which has control over the generated HTML, you can append a query string to each form element with method=post. This method is only reliable if the POST requests are not scripted (AJAX), but initiated through a form.

Example code:

javascript:(function(){
    var form = document.forms, i=form.length-1; 
    for(; i>=0; i--) {
        if(/post/i.test(form[i].method)) form[i].action += "#method-post";
    }
    //check whether the hash contains `#method-post`
    var is_post = location.hash.indexOf("#method-post") != -1;
    //Optionally, remove the hash to not interfere with the scripts at the page:
    //location.hash = location.hash.replace('#method-post', '');
})();

Location hashes are not submitted to the server, but passed by the browser. This solution works perfectly for extensions, but possibly inaccurate for bookmarklets, since the user should always activate it.

Comments

[Martin Vilcans]

Now that I know that it's impossible, I'll probably go for something like this solution. It can be done pretty easily by listening to submit events.