How to get response url in XMLHttpRequest?

Question

There is a page (url), I request it by XMLHttpRequest, but I'm not getting response from requested url, It's directing request to another page,

requesting --- > page.php
getting reponse from > directedpage.php

and the question is how can I get response url? (directedpage.php in example)

Solution

The final URL (after following all redirects) is available in the responseURL attribute of a XMLHttpRequest instance. This feature is new and only supported in Firefox 32 ^{stable in September 2014 [ref]} and Chrome 37.0.2031.0 ^{stable in August 2014 [ref]} (and probably also Opera 24). responseURL is not (yet) supported in IE 11 or Safari 7 and older browsers. For these browsers, the previous answer is still true:

XMLHttpRequest automatically follows redirects, without saving the served URLs in a property. The Location header can neither be retrieved through the .getResponseHeader().

References:

• https://groups.google.com/a/chromium.org/d/msg/blink-dev/AU6pAiYZ8J4/ec5jgoEDsF0J
• https://bugzilla.mozilla.org/show_bug.cgi?id=998076

Comments

[Julien Palard]

OK, but, does someone know why ? Security ? Which attack should be available with the response url ? (Giving response url only if response url is in the same origin than the original url)

[Rob W]

@JulienPalard The specification demands that redirects have to be followed transparently.

[user2284570]

@RobW : I don’t understand, if I have thisA=302—B=302—>C=302—>A=200. What responseURL will return ? The ᴜʀʟ of C or A ?

[Rob W]

@user2284570 The URL of the last A.

[user2284570]

@RobW : And in the case of a circled redirect ?

[Rob W]

@user2284570 It will probably be null, because the browser will detect the redirect loop and abort the request.

[traxium]

Is it impossible to get responseURL for blocked CORS requests?

[Rob W]

@traxium It is not possible to get responseURL for blocked cross-origin requests. If the server did not respond with the expected CORS response headers. then the browser has to assume that the server is not willing to volunteer sensitive information and therefore it will not leak the redirection target to the script.