For some browsers (for instance, for Chromium and FF) we could use "Accept" header to detect request content type.
For instance, here is an image loading with <img> tag:
Accept: image/webp,image/*,*/*;q=0.8
Does not work <script> tags.
Works for <link> in case if type is specified:
Accept:text/css,*/*;q=0.1
Document:
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
We can use Origin header as marker for xmlhttprequest.
If Accept starts with application/json, it is most likely XHR as well:
application/json, text/javascript, */*; q=0.01
For some browsers (for instance, for Chromium and FF) we could use "Accept" header to detect request content type.
For instance, here is an image loading with
<img>tag:Accept: image/webp,image/*,*/*;q=0.8Does not work
<script>tags.Works for
<link>in case if type is specified:Accept:text/css,*/*;q=0.1Document:
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8We can use
Originheader as marker for xmlhttprequest.If
Acceptstarts withapplication/json, it is most likely XHR as well:application/json, text/javascript, */*; q=0.01