X-Requested-With

​

Overview

• AJAX request validation
• CSRF protection layer
• Request origin verification

​

Installation

import "github.com/go-mizu/mizu/middlewares/xrequestedwith"

​

Quick Start

app := mizu.New()

// Require X-Requested-With: XMLHttpRequest
app.Use(xrequestedwith.New())

​

Configuration

​

Options

​

Examples

​

Basic Validation

app.Use(xrequestedwith.New())
// Requires: X-Requested-With: XMLHttpRequest

​

Custom Value

app.Use(xrequestedwith.New(xrequestedwith.Options{
    Value: "MyApp",
}))
// Requires: X-Requested-With: MyApp

​

Specific Methods

app.Use(xrequestedwith.New(xrequestedwith.Options{
    Methods: []string{"POST", "PUT", "DELETE"},
}))

​

Detection Only

app.Use(xrequestedwith.New(xrequestedwith.Options{
    Required: false, // Don't reject, just detect
}))

app.Get("/", func(c *mizu.Ctx) error {
    if xrequestedwith.IsAJAX(c) {
        return c.JSON(200, data)
    }
    return c.HTML(200, page)
})

​

API Reference

​

Functions

// New creates X-Requested-With middleware
func New(opts ...Options) mizu.Middleware

// IsAJAX returns true if AJAX request
func IsAJAX(c *mizu.Ctx) bool

​

Client Usage

// jQuery sets this automatically
$.ajax({url: '/api', type: 'POST', data: data});

// Fetch/XMLHttpRequest
fetch('/api', {
    method: 'POST',
    headers: {
        'X-Requested-With': 'XMLHttpRequest'
    }
});

​

Technical Details

​

Implementation Overview

1. Method Filtering: Checks if the request method is in the skip list (default: GET, HEAD, OPTIONS)
2. Path Filtering: Checks if the request path is in the skip paths list
3. Header Validation: Compares the X-Requested-With header value (case-insensitive) against the expected value
4. Error Handling: Returns either a custom error handler response or a default 400 Bad Request

​

Internal Components

• Skip Methods Map: Pre-built map of HTTP methods to skip (defaults to safe methods)
• Skip Paths Map: Pre-built map of paths to exclude from validation
• Case-Insensitive Comparison: Uses strings.EqualFold for header value matching
• Default Value: “XMLHttpRequest” is used when no custom value is specified

​

Function Variants

​

Security Note

• CSRF tokens
• SameSite cookies
• Origin validation

​

Best Practices

• Use as additional security layer
• Combine with CSRF middleware
• Don’t rely on it alone
• Document header requirement for clients

​

Testing

​

Related Middlewares

• csrf - CSRF protection
• cors - CORS handling
• bot - Bot detection