By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement . We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The XMLHttpRequest used by the fetch polyfill is an implementation detail. When browsers start shipping window.fetch natively, the X-Requested-With header won't be sent along with the request. So it would be an error to rely on that header being sent from the polyfill.

Here's a simple fetch wrapper we're using at GitHub that provides some of the missing behavior from Rails' integration with jQuery.

https://gist.github.com/dgraham/92e4c45da3707a3fe789

In practice, sites are going to need a small wrapper like this to work with window.fetch as easily as jQuery's $.ajax .

/cc @annevk This wrapper might or might not inform the fetch spec.

@dgraham that wrapper seems to assume a document environment. The CSRF stuff would break in a worker environment.

@dgraham if you want standardized CSRF tokens, perhaps email [email protected] or [email protected] (need to subscribe first for the former). Might be worth doing.