Refused to set unsafe header Connection/Content-length

Question

I'm working on a website and I have a problem right here. On the page I'm working, the user puts an ip address and the ports he wants to be searched. This is being made with ajax (user side) and php (server side). Ajax sends the ip and port (one by one) to the php file, and he returns the result of the port. The goal is that user sees what's the port is being tested (in a div element) at the moment, and here is where the problem is. He runs/works well, he tests all the ports the user wants to, but during the test period he shows no port, just shows the final port (after all previous ports have been tested) and the result of the ports (if some port had a result) which appears in a distinct div element. This just works perfectly in Firefox, in other browsers happens what I just explained. The Google Chrome console says: Refused to set unsafe header "Content-length" and Refused to set unsafe header "Connection". I've been searching about this problem for days and I found so many things and I tried them, but none of them solved the problem.

Here is my code.

jquery.js

function HttpRequest(endereco, portainicio)
{      
    var xmlhttp;
    var params = "endereco="+endereco+"&"+"porta="+portainicio;

    if (window.XMLHttpRequest) // IE7+, Firefox, Chrome, Opera, Safari
    {
        xmlhttp = new XMLHttpRequest();
    }

    else // IE6, IE5
    {
        xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
    }

    xmlhttp.open("POST", "/firewall/ajax", false);

    //alert(params);

    xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
    xmlhttp.setRequestHeader("Content-length", params.length);
    xmlhttp.setRequestHeader("Connection", "close");

    xmlhttp.send(params);
    return xmlhttp.responseText;
}

function ajaxfirewall()
{
    (...)

    var resposta;

    $("p.ip").append("<span class='end'> "+endereco+"</span>");       

    for (portainicio; portainicio <= portafinal; portainicio++)
    {   
        resposta = HttpRequest(endereco, portainicio);              
        $("p.porta").append(" <span class='tporta'>"+ resposta+"</span><br>");
    }

    return false;
}

Another thing it's really strange. Do you see those alert(params); which are commented in the HttpRequest function? If I leave it uncommented it displays the port which is being tested, but it shows the alert and I don't want that.

possible duplicate of [AJAX post error : Refused to set unsafe header "Connection"](http://stackoverflow.com/questions/7210507/ajax-post-error-refused-to-set-unsafe-header-connection) — Wladimir Palant, Dec 03 '14 at 18:56

score 1 · Answer 1 · edited May 23 '17 at 12:34

1

Without the HTML your jquery.js is supposed to work on this involves some guesswork (maybe you could post the relevant excerpt (Hint, hint)). I would consider it possible that $("p.porta") cannot be found or that the appended HTML reacts in an unexpected way. You should try to just print your results to console using e.g. console.log (that is you are using Firebug or some such) in order to see what you get at what time. Maybe you will find something on the client side too.

Update Judging from this question and its accepted answer the Chrome behavior is actually what you should expect. The standard for XMLHttpRequests prescribes that these two headers should not be set by the client in order to avoid request smuggling attacks. You just should not set them (even if your PHP source tells you to).

edited May 23 '17 at 12:34

Community

1
1

answered May 19 '14 at 16:16

Patru

4,481
2
32
42

I did that and I get the results. As I said previously, it works, but doesn't show the port which is being tested. – mathiaz May 21 '14 at 09:55
Are you sure you are not just "too fast" for being seen? Maybe you can factor it out into a function and `setTimeout` before your next try? – Patru May 21 '14 at 10:31
It's not too fast because it works on Firefox and it takes 1/2 seconds to change the port. – mathiaz May 21 '14 at 14:09
@mathiaz you should omit the two headers, the browser will set them. Maybe you can add a button to test adding the responses before you include it into this script. – Patru May 22 '14 at 09:01
@mathiaz could you put your JavaScript and some relevant HTML into a [JSFiddle](http://jsfiddle.net/Nu2Ze/) to demonstrate the effect? – Patru May 22 '14 at 10:17
Please have a look at this one : http://stackoverflow.com/questions/7210507/ajax-post-error-refused-to-set-unsafe-header-connection – hugsbrugs Sep 18 '15 at 23:17

Refused to set unsafe header Connection/Content-length

1 Answers1