Can Javascript tell if page was result of a GET or POST?

Question

Possible Duplicate:
Client-side detection of HTTP request method

I'm working on Javascript that is injected on any page. The script is injected on servers that I'm not controlling. (Injection is done with an add-on or bookmarklet.)

The Javascript needs to know whether the page was loaded as the result of an HTTP GET or POST. The reason for this is that if the page was loaded with a GET, the URL is an identifier for the page that can be bookmarked, shared with others, etc. In case of a POST, I need to handle it differently.

Can this be done? I have found no way of accessing the request from Javascript, but perhaps there is some trick that I don't know of.

check the page's URL for GET values? Use `document.location.href` — Ayush, Nov 16 '11 at 10:14
`http://somewhere.com/foo.php?id=1&foo=2` can also be a POST request though, @xbonez — Matt, Nov 16 '11 at 10:15
@xbonez: QueryString part of the URL doesn't have anything to do with HTTP request method. — Crozin, Nov 16 '11 at 10:16
hmm...true. I doubt there would be a way, in that case, since the POST/GET request is made at the server while JS would run at the client — Ayush, Nov 16 '11 at 10:16
Just because a page was loaded from a GET doesn't mean it is bookmarkable. The site/app could be completely stateful. — Richard H, Nov 16 '11 at 10:22
Pages that are results of a POST request are not really meant to be bookmarked/shared. Normally, if the developer follows the PRG pattern, there won't even be pages like that. My suggestion is not to care about the POST requests, the pages that result from those are specific to the interaction between the server and that specific client. — kapa, Nov 16 '11 at 10:23

score 4 · Accepted Answer · edited Jun 20 '20 at 09:12

I think you can't.

Brendan Eich just confirmed that last night on his twitter, in a conversation with dhh.

Reproducing here:

@dhh: Is there any continued reason why JavaScript can't access HTTP headers in the browser outside of Ajax? And what's the historic reason?

@BrendanEich: @dhh @lostconvos no good reason -- I had no time in the old days (apart from document.cookie and navigator.userAgent), no one followed up.

@dhh: Could we just borrow the API from xhr: getResponseHeader() and getAllResponseHeaders()?

I suggest you follow both in case you are interested on this matter.

In the meantime, I think the best you can do is having two different javascripts - one for POST pages and another one for the rest. You give both to your providers and tell them how to use them. But yes, this involves cooperation from the servers.

score 1 · Answer 2 · answered Nov 16 '11 at 10:43

It's not possible to directly retrieve the POST data of a webpage; Imagine that it's possible. Then, the sensitive data, submitted through a POST request can also be read, which is obviously not desired.

If you're writing an extension/userscript which has control over the generated HTML, you can append a query string to each form element with method=post. This method is only reliable if the POST requests are not scripted (AJAX), but initiated through a form.

Example code:

javascript:(function(){
    var form = document.forms, i=form.length-1; 
    for(; i>=0; i--) {
        if(/post/i.test(form[i].method)) form[i].action += "#method-post";
    }
    //check whether the hash contains `#method-post`
    var is_post = location.hash.indexOf("#method-post") != -1;
    //Optionally, remove the hash to not interfere with the scripts at the page:
    //location.hash = location.hash.replace('#method-post', '');
})();

Location hashes are not submitted to the server, but passed by the browser. This solution works perfectly for extensions, but possibly inaccurate for bookmarklets, since the user should always activate it.

Now that I know that it's impossible, I'll probably go for something like this solution. It can be done pretty easily by listening to submit events. — Martin Vilcans, Nov 16 '11 at 11:20

Can Javascript tell if page was result of a GET or POST?

2 Answers2