index.html 91.2 KB

Raw Blame History Permalink

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN">

<html lang=en-US>
 <head>
  <title>XMLHttpRequest</title>

  <style type="text/css">
   pre.idl { border:solid thin; background:#eee; color:#000; padding:0.5em }
   pre.idl :link, pre.idl :visited { color:inherit; background:transparent }
   pre code { color:inherit; background:transparent }
   div.example { margin-left:1em; padding-left:1em; border-left:double; color:#222; background:#fcfcfc }
   .note { margin-left:2em; font-weight:bold; font-style:italic; color:#008000 }
   p.note::before { content:"Note: " }
   .XXX { padding:.5em; border:solid #f00 }
   p.XXX::before { content:"Issue: " }
   dl.switch { padding-left:2em }
   dl.switch > dt { text-indent:-1.5em }
   dl.switch > dt:before { content:'\21AA'; padding:0 0.5em 0 0; display:inline-block; width:1em; text-align:right; line-height:0.5em }
   dl.domintro { color: green; margin: 2em 0 2em 2em; padding: 0.5em 1em; border: none; background: #DDFFDD; }
   dl.domintro dt, dl.domintro dt * { color: black; text-decoration: none; }
   dl.domintro dd { margin: 0.5em 0 1em 2em; padding: 0; }
   dl.domintro dd p { margin: 0.5em 0; }
   dl.domintro:before { display: table; margin: -1em -0.5em -0.5em auto; width: auto; content: 'This box is non-normative. Implementation requirements are given below this box.'; color: red; border: solid 2px; background: white; padding: 0 0.25em; }
   em.ct { text-transform:lowercase; font-variant:small-caps; font-style:normal }
   dfn { font-weight:bold; font-style:normal }
   code { color:orangered }
   code :link, code :visited { color:inherit }
   hr:not(.top) { display:block; background:none; border:none; padding:0; margin:2em 0; height:auto }
   table { border-collapse:collapse; border-style:hidden hidden none hidden }
   table thead { border-bottom:solid }
   table tbody th:first-child { border-left:solid }
   table td, table th { border-left:solid; border-right:solid; border-bottom:solid thin; vertical-align:top; padding:0.2em }
  </style>
  <link href="http://www.w3.org/StyleSheets/TR/W3C-CR" rel=stylesheet>

 <body>
  <div class=head>
   <p><a href="http://www.w3.org/"><img alt=W3C height=48
    src="http://www.w3.org/Icons/w3c_home" width=72></a></p>

   <h1 class=head id=the-xmlhttprequest-object>XMLHttpRequest</h1>

   <h2 class="no-num no-toc" id=w3c-doctype>W3C Candidate Recommendation 3
    August 2010</h2>

   <dl>
    <dt>This Version:

    <dd><a
     href="http://www.w3.org/TR/2010/CR-XMLHttpRequest-20100803/">http://www.w3.org/TR/2010/CR-XMLHttpRequest-20100803/</a>

    <dt>Latest Version:

    <dd><a
     href="http://www.w3.org/TR/XMLHttpRequest/">http://www.w3.org/TR/XMLHttpRequest/</a>

    <dt>Latest Editor Version:

    <dd><a
     href="http://dev.w3.org/2006/webapi/XMLHttpRequest/">http://dev.w3.org/2006/webapi/XMLHttpRequest/</a>

    <dt>Previous Versions:

    <dd><a
     href="http://www.w3.org/TR/2009/WD-XMLHttpRequest-20091119/">http://www.w3.org/TR/2009/WD-XMLHttpRequest-20091119/</a>

    <dd><a
     href="http://www.w3.org/TR/2009/WD-XMLHttpRequest-20090820/">http://www.w3.org/TR/2009/WD-XMLHttpRequest-20090820/</a>

    <dd><a
     href="http://www.w3.org/TR/2008/WD-XMLHttpRequest-20080415/">http://www.w3.org/TR/2008/WD-XMLHttpRequest-20080415/</a>

    <dd><a
     href="http://www.w3.org/TR/2007/WD-XMLHttpRequest-20071026/">http://www.w3.org/TR/2007/WD-XMLHttpRequest-20071026/</a>

    <dd><a
     href="http://www.w3.org/TR/2007/WD-XMLHttpRequest-20070618/">http://www.w3.org/TR/2007/WD-XMLHttpRequest-20070618/</a>

    <dd><a
     href="http://www.w3.org/TR/2007/WD-XMLHttpRequest-20070227/">http://www.w3.org/TR/2007/WD-XMLHttpRequest-20070227/</a>

    <dd><a
     href="http://www.w3.org/TR/2006/WD-XMLHttpRequest-20060927/">http://www.w3.org/TR/2006/WD-XMLHttpRequest-20060927/</a>

    <dd><a
     href="http://www.w3.org/TR/2006/WD-XMLHttpRequest-20060619/">http://www.w3.org/TR/2006/WD-XMLHttpRequest-20060619/</a>

    <dd><a
     href="http://www.w3.org/TR/2006/WD-XMLHttpRequest-20060405/">http://www.w3.org/TR/2006/WD-XMLHttpRequest-20060405/</a>

    <dt>Editor:

    <dd><a href="http://annevankesteren.nl/">Anne van Kesteren</a> (<a
     href="http://www.opera.com/">Opera Software ASA</a>) &lt;<a
     href="mailto:annevk@opera.com">annevk@opera.com</a>&gt;
   </dl>

   <p class=copyright><a
    href="http://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a>
    &copy; 2009 <a href="http://www.w3.org/"><acronym title="World Wide Web
    Consortium">W3C</acronym></a><sup>&reg;</sup> (<a
    href="http://www.csail.mit.edu/"><acronym title="Massachusetts Institute
    of Technology">MIT</acronym></a>, <a
    href="http://www.ercim.org/"><acronym title="European Research Consortium
    for Informatics and Mathematics">ERCIM</acronym></a>, <a
    href="http://www.keio.ac.jp/">Keio</a>), All Rights Reserved. W3C <a
    href="http://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>,
    <a
    href="http://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a>
    and <a
    href="http://www.w3.org/Consortium/Legal/copyright-documents">document
    use</a> rules apply.</p>
  </div>

  <hr>

  <h2 class="no-num no-toc" id=specabstract>Abstract</h2>

  <p>The XMLHttpRequest specification defines an API that provides scripted
   client functionality for transferring data between a client and a server.

  <h2 class="no-num no-toc" id=sotd>Status of this Document</h2>

  <p><em>This section describes the status of this document at the time of
   its publication. Other documents may supersede this document. A list of
   current W3C publications and the latest revision of this technical report
   can be found in the <a href="http://www.w3.org/TR/">W3C technical reports
   index</a> at http://www.w3.org/TR/.</em>

  <p>This is the 3 August 2010 <!--Last Call Working Draft-->W3C Candidate
   Recommendation of XMLHttpRequest. Please send comments to <a
   href="mailto:public-webapps@w3.org?subject=[XHR]%20">public-webapps@w3.org</a>
   (<a
   href="http://lists.w3.org/Archives/Public/public-webapps/">archived</a>)
   with <samp>[XHR]</samp> at the start of the subject line.

  <p>For the last Last Call Working Draft the Working Group has kept a <a
   href="http://dev.w3.org/2006/webapi/XMLHttpRequest/disposition-of-comments-3">disposition
   of comments</a> document. A <a
   href="http://dev.w3.org/cvsweb/2006/webapi/XMLHttpRequest/Overview.src.html">list
   of changes</a> is available via a Web view of CVS. (Due to the way the
   document is edited certain commit messages have introduced negligible
   changes to this document and are in fact only relevant for XMLHttpRequest
   Level 2.)

  <p>This document is produced by the <a
   href="http://www.w3.org/2008/webapps/">Web Applications</a> (WebApps)
   Working Group. The WebApps Working Group is part of the <a
   href="http://www.w3.org/2006/rwc/Activity">Rich Web Clients Activity</a>
   in the W3C <a href="http://www.w3.org/Interaction/">Interaction
   Domain</a>.

  <p>This document was produced by a group operating under the <a
   href="http://www.w3.org/Consortium/Patent-Policy-20040205/">5 February
   2004 W3C Patent Policy</a>. W3C maintains a <a
   href="http://www.w3.org/2004/01/pp-impl/42538/status"
   rel=disclosure>public list of any patent disclosures</a> made in
   connection with the deliverables of the group; that page also includes
   instructions for disclosing a patent. An individual who has actual
   knowledge of a patent which the individual believes contains <a
   href="http://www.w3.org/Consortium/Patent-Policy-20040205/#def-essential">Essential
   Claim(s)</a> must disclose the information in accordance with <a
   href="http://www.w3.org/Consortium/Patent-Policy-20040205/#sec-Disclosure">section
   6 of the W3C Patent Policy</a>.

  <p>Publication as a W3C Candidate Recommendation does not imply endorsement
   by the W3C Membership. This is a draft document and may be updated,
   replaced or obsoleted by other documents at any time. It is inappropriate
   to cite this document as other than work in progress.

  <h3 class="no-num no-toc" id=crec>Candidate Recommendation Exit Criteria</h3>

  <p>To exit the Candidate Recommendation (CR) stage the following criteria
   <em class=ct>must</em> have been met:

  <ol>
   <li>There will be at least two interoperable implementations passing all
    test cases in the <a
    href="http://test.w3.org/webapps/tests/XMLHttpRequest/info.htm">test
    suite</a> for this specification. An implementation is to be available
    (i.e. for download), shipping (i.e. not private), and not experimental
    (i.e. intended for a wide audience). The working group will decide when
    the test suite is of sufficient quality to test interoperability and will
    produce implementation reports (hosted together with the test suite).

   <li>A minimum of six months of the CR stage will have elapsed (i.e. not
    until after 3 February 2011). This is to ensure that enough time is given
    for any remaining major errors to be caught. The CR period will be
    extended if implementations are slow to appear.

   <li>Text, which can be in a separate document, exists that explains the
    security considerations for this specification. This may be done in a
    generic manner as they are most likely applicable to various APIs. The
    working group will decide whether the text is of sufficient quality.
  </ol>

  <h2 class="no-num no-toc" id=toc>Table of Contents</h2>
  <!--begin-toc-->

  <ul class=toc>
   <li><a href="#introduction"><span class=secno>1. </span>Introduction</a>

   <li><a href="#conformance"><span class=secno>2. </span>Conformance
    Criteria</a>
    <ul class=toc>
     <li><a href="#dependencies"><span class=secno>2.1.
      </span>Dependencies</a>

     <li><a href="#terminology"><span class=secno>2.2. </span>Terminology</a>


     <li><a href="#extensibility"><span class=secno>2.3.
      </span>Extensibility</a>
    </ul>

   <li><a href="#the-xmlhttprequest-interface"><span class=secno>3.
    </span>The <code title="">XMLHttpRequest</code> Interface</a>
    <ul class=toc>
     <li><a href="#origin-and-base-url"><span class=secno>3.1. </span>Origin
      and Base URL</a>

     <li><a href="#task-sources"><span class=secno>3.2. </span>Task
      Sources</a>

     <li><a href="#constructors"><span class=secno>3.3.
      </span>Constructors</a>

     <li><a href="#event-handler-attributes"><span class=secno>3.4.
      </span>Event Handler Attributes</a>

     <li><a href="#states"><span class=secno>3.5. </span>States</a>

     <li><a href="#request"><span class=secno>3.6. </span>Request</a>
      <ul class=toc>
       <li><a href="#the-open-method"><span class=secno>3.6.1. </span>The
        <code title="">open()</code> method</a>

       <li><a href="#the-setrequestheader-method"><span class=secno>3.6.2.
        </span>The <code title="">setRequestHeader()</code> method</a>

       <li><a href="#the-send-method"><span class=secno>3.6.3. </span>The
        <code title="">send()</code> method</a>

       <li><a href="#infrastructure-for-the-send-method"><span
        class=secno>3.6.4. </span>Infrastructure for the <code
        title="">send()</code> method</a>

       <li><a href="#the-abort-method"><span class=secno>3.6.5. </span>The
        <code title="">abort()</code> method</a>
      </ul>

     <li><a href="#response"><span class=secno>3.7. </span>Response</a>
      <ul class=toc>
       <li><a href="#the-status-attribute"><span class=secno>3.7.1.
        </span>The <code title="">status</code> attribute</a>

       <li><a href="#the-statustext-attribute"><span class=secno>3.7.2.
        </span>The <code title="">statusText</code> attribute</a>

       <li><a href="#the-getresponseheader-method"><span class=secno>3.7.3.
        </span>The <code title="">getResponseHeader()</code> method</a>

       <li><a href="#the-getallresponseheaders-method"><span
        class=secno>3.7.4. </span>The <code
        title="">getAllResponseHeaders()</code> method</a>

       <li><a href="#response-entity-body0"><span class=secno>3.7.5.
        </span>Response Entity Body</a>

       <li><a href="#the-responsetext-attribute"><span class=secno>3.7.6.
        </span>The <code title="">responseText</code> attribute</a>

       <li><a href="#the-responsexml-attribute"><span class=secno>3.7.7.
        </span>The <code title="">responseXML</code> attribute</a>
      </ul>
    </ul>

   <li><a href="#exceptions"><span class=secno>4. </span>Exceptions</a>

   <li class=no-num><a href="#references">References</a>

   <li class=no-num><a href="#acknowledgments">Acknowledgments</a>
  </ul>
  <!--end-toc-->

  <h2 id=introduction><span class=secno>1. </span>Introduction</h2>

  <p><em>This section is non-normative.</em>

  <p>The <a href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object
   implements an interface exposed by a scripting engine that allows scripts
   to perform HTTP client functionality, such as submitting form data or
   loading data from a server. It is the ECMAScript HTTP API.

  <p>The name of the object is <a
   href="#xmlhttprequest"><code>XMLHttpRequest</code></a> for compatibility
   with the Web, though each component of this name is potentially
   misleading. First, the object supports any text based format, including
   XML. Second, it can be used to make requests over both HTTP and HTTPS
   (some implementations support protocols in addition to HTTP and HTTPS, but
   that functionality is not covered by this specification). Finally, it
   supports "requests" in a broad sense of the term as it pertains to HTTP;
   namely all activity involved with HTTP requests or responses for the
   defined HTTP methods.

  <div class=example>
   <p>Some simple code to do something with data from an XML document fetched
    over the network:</p>

   <pre><code>function test(data) {
 // taking care of data
}

function handler() {
 if(this.readyState == 4 &amp;&amp; this.status == 200) {
  // so far so good
  if(this.responseXML != null &amp;&amp; this.responseXML.getElementById('test').firstChild.data)
     // success!
   test(this.responseXML.getElementById('test').firstChild.data);
  else
   test(null);
 } else if (this.readyState == 4 &amp;&amp; this.status != 200) {
  // fetched the wrong page or network error...
  test(null);
 }
}

var client = new XMLHttpRequest();
client.onreadystatechange = handler;
client.open("GET", "unicorn.xml");
client.send();</code></pre>

   <p>If you just want to log a message to the server:</p>

   <pre><code>function log(message) {
 var client = new XMLHttpRequest();
 client.open("POST", "/log");
 client.setRequestHeader("Content-Type", "text/plain;charset=UTF-8");
 client.send(message);
}</code></pre>

   <p>Or if you want to check the status of a document on the server:</p>

   <pre><code>function fetchStatus(address) {
 var client = new XMLHttpRequest();
 client.onreadystatechange = function() {
  // in case of network errors this might not give reliable results
  if(this.readyState == 4)
   returnStatus(this.status);
 }
 client.open("HEAD", address);
 client.send();
}</code></pre>
  </div>

  <h2 id=conformance><span class=secno>2. </span>Conformance Criteria</h2>

  <p>Everything in this specification is normative except for diagrams,
   examples, notes and sections marked non-normative.

  <p>The key words <em class=ct>must</em>, <em class=ct>must not</em>, <em
   class=ct>should</em>, <em class=ct>should not</em>, and <em
   class=ct>may</em> in this document are to be interpreted as described in
   RFC 2119. [<cite><a href="#ref-rfc2119">RFC2119</a></cite>]

  <p>This specification defines the following classes of products:

  <dl>
   <dt><dfn id=conforming-user-agent>Conforming user agent</dfn>

   <dd>
    <p>A user agent <em class=ct>must</em> behave as described in this
     specification in order to be considered conformant.</p>

    <p>If the user agent is not a <a
     href="#conforming-xml-user-agent">conforming XML user agent</a> the
     <span>XML response entity body</span> <em class=ct>must</em> (always) be
     null.</p>

    <p>User agents <em class=ct>may</em> implement algorithms given in this
     specification in any way desired, so long as the end result is
     indistinguishable from the result that would be obtained by the
     specification's algorithms.</p>

    <p class=note>This specification uses both the terms "conforming user
     agent(s)" and "user agent(s)" to refer to this product class.</p>

   <dt><dfn id=conforming-xml-user-agent>Conforming XML user agent</dfn>

   <dd>
    <p>An XML user agent <em class=ct>must</em> be a <a
     href="#conforming-user-agent">conforming user agent</a> and <em
     class=ct>must</em> be a conforming XML processor that reports violations
     of namespace well-formedness. [<cite><a href="#ref-xml">XML</a></cite>]
  </dl>

  <h3 id=dependencies><span class=secno>2.1. </span>Dependencies</h3>

  <p>This specification relies on several underlying specifications.

  <dl>
   <dt>DOM

   <dd>
    <p>A <a href="#conforming-user-agent" title="conforming user
     agent">conforming user agent</a> <em class=ct>must</em> support at least
     the subset of the functionality defined in DOM Events and DOM Core that
     this specification relies upon, such as various exceptions and
     <code>EventTarget</code>. [<cite><a
     href="#ref-dom2events">DOM2Events</a></cite>] [<cite><a
     href="#ref-dom3core">DOM3Core</a></cite>]

   <dt>HTML5

   <dd>
    <p>A <a href="#conforming-user-agent">conforming user agent</a> <em
     class=ct>must</em> support at least the subset of the functionality
     defined in HTML5 that this specification relies upon, such as the basics
     of the <code>Window</code> object and serializing a
     <code>Document</code> object. [<cite><a
     href="#ref-html5">HTML5</a></cite>]</p>

    <p class=note>The <a
     href="http://www.w3.org/TR/2006/WD-Window-20060407/">Window Object
     1.0</a> draft is not referenced normatively as it appears to be no
     longer maintained and HTML5 defines the <code>Window</code> object in
     more detail. This specification already depends on HTML5 for other
     reasons so there is not much additional overhead because of this.</p>

   <dt>HTTP

   <dd>
    <p>A <a href="#conforming-user-agent" title="conforming user
     agent">conforming user agent</a> <em class=ct>must</em> support some
     version of the HTTP protocol. Requirements regarding HTTP are made
     throughout the specification. [<cite><a
     href="#rfc-rfc2616">RFC2616</a></cite>]

   <dt>Web IDL

   <dd>
    <p>A <a href="#conforming-user-agent">conforming user agent</a> <em
     class=ct>must</em> also be a conforming implementation of the IDL
     fragments in this specification, as described in the Web IDL
     specification. [<cite><a href="#ref-webidl">WebIDL</a></cite>]
  </dl>

  <h3 id=terminology><span class=secno>2.2. </span>Terminology</h3>

  <p><dfn id=dfn-obtain-unicode>Convert a DOMString to a sequence of Unicode
   characters</dfn> is defined by the Web IDL specification. [<cite><a
   href="#ref-webidl">WebIDL</a></cite>]

  <p>The term <dfn id=user-credentials>user credentials</dfn> for the
   purposes of this specification means cookies, HTTP authentication, and
   client-side SSL certificates. Specifically it does not refer to proxy
   authentication or the <code title=http-origin>Origin</code> header. <a
   href="#ref-cookies">[COOKIES]</a> <!-- XXX ref? -->

  <p>The terms and algorithms <dfn
   id=url-fragment><code>&lt;fragment></code></dfn>, <dfn
   id=url-scheme><code>&lt;scheme></code></dfn>, <dfn
   id=cookie-free-document-object>cookie-free <code>Document</code>
   object</dfn>, <dfn id=document-base-url>document base URL</dfn>, <dfn
   id=document-character-encoding>document's character encoding</dfn>, <dfn
   id=event-handler-attributes-0>event handler attributes</dfn>, <dfn
   id=event-handler-event-type>event handler event type</dfn>, <dfn
   id=fetch>fetch</dfn>, <dfn id=fully-active>fully active</dfn>, <dfn
   id=function><code>Function</code></dfn>, <dfn id=dom-innerhtml
   title=dom-innerHTML><code>innerHTML</code></dfn>, <dfn
   id=origin>origin</dfn>, <dfn id=preferred-mime-name>preferred MIME
   name</dfn>, <dfn id=resolve-a-url>resolve a URL</dfn>, <dfn
   id=same-origin>same origin</dfn>, <dfn id=storage-mutex>storage
   mutex</dfn>, <dfn id=task>task</dfn>, <dfn id=task-source>task
   source</dfn>, <dfn id=task-queues>task queues</dfn>, <dfn
   id=url>URL</dfn>, <dfn id=url-character-encoding>URL character
   encoding</dfn>, <dfn id=queue-a-task>queue a task</dfn>, and <dfn
   id=valid-mime-type>valid MIME type</dfn> are defined by the HTML5
   specification. [<cite><a href="#ref-html5">HTML5</a></cite>]

  <p>The term <dfn id=entity-body>entity body</dfn> is used as described in
   RFC 2616. <dfn id=method-token>Method token</dfn> is used as described in
   section 5.1.1 of RFC 2616. <dfn
   id=field-name><code>field-name</code></dfn> and <dfn
   id=field-value><code>field-value</code></dfn> are used as described in
   section 4.2 of RFC 2616. [<cite><a href="#rfc-rfc2616">RFC2616</a></cite>]

  <p>To <dfn id=deflate-a-domstring-into-a-byte-sequence>deflate a DOMString
   into a byte sequence</dfn> means to create a sequence of bytes such that
   the <var title="">n</var>th byte of the sequence is equal to the low-order
   byte of the <var title="">n</var>th code point in the original DOMString.

  <p>To <dfn id=inflate-a-byte-sequence-into-a-domstring>inflate a byte
   sequence into a DOMString</dfn> means to create a DOMString such that the
   <var title="">n</var>th code point has 0x00 as the high-order byte and the
   <var title="">n</var>th byte of the byte sequence as the low-order byte.

  <p><dfn id=userinfo><code>userinfo</code></dfn> is used as described in
   section 3.2.1 of RFC 3986. [<cite><a
   href="#ref-rfc3986">RFC3986</a></cite>]

  <p>To <dfn id=dispatch-readystatechange-event>dispatch a
   <code>readystatechange</code> event</dfn> means that an event with the
   name <code title=event-xhr-readystatechange>readystatechange</code>, which
   does not bubble and is not cancelable, and which uses the
   <code>Event</code> interface, is to be dispatched at the <a
   href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object.

  <h3 id=extensibility><span class=secno>2.3. </span>Extensibility</h3>

  <p>User agents, Working Groups, and other interested parties are
   <em>strongly encouraged</em> to discuss extensions on a relevant public
   forum, preferably <a
   href="mailto:public-webapps@w3.org">public-webapps@w3.org</a>. If this is
   for some reason not possible prefix the extension in some way and start
   the prefix with an uppercase letter. E.g. if company Foo wants to add a
   private method <code>bar()</code> it could be named <code>FooBar()</code>
   to prevent clashes with a potential future standardized
   <code>bar()</code>.

  <h2 id=the-xmlhttprequest-interface><span class=secno>3. </span>The <code
   title="">XMLHttpRequest</code> Interface</h2>

  <p>The <a href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object can
   be used by scripts to programmatically connect to their originating server
   via HTTP.

  <pre class=idl>[NoInterfaceObject]
interface <dfn id=xmlhttprequesteventtarget>XMLHttpRequestEventTarget</dfn> : EventTarget {
  // for future use
};

[<a href="#dom-xmlhttprequest" title=dom-XMLHttpRequest>Constructor</a>]
interface <dfn id=xmlhttprequest>XMLHttpRequest</dfn> : <a href="#xmlhttprequesteventtarget">XMLHttpRequestEventTarget</a> {
  // <a href="#event-handler-attributes">event handler attributes</a>
           attribute <a href="#function">Function</a> <a href="#handler-xhr-onreadystatechange" title=handler-xhr-onreadystatechange>onreadystatechange</a>;

  // <a href="#states">states</a>
  const unsigned short <a href="#dom-xmlhttprequest-unsent" title=dom-XMLHttpRequest-UNSENT>UNSENT</a> = 0;
  const unsigned short <a href="#dom-xmlhttprequest-opened" title=dom-XMLHttpRequest-OPENED>OPENED</a> = 1;
  const unsigned short <a href="#dom-xmlhttprequest-headers_received" title="dom-XMLHttpRequest-HEADERS_RECEIVED">HEADERS_RECEIVED</a> = 2;
  const unsigned short <a href="#dom-xmlhttprequest-loading" title=dom-XMLHttpRequest-LOADING>LOADING</a> = 3;
  const unsigned short <a href="#dom-xmlhttprequest-done" title=dom-XMLHttpRequest-DONE>DONE</a> = 4;
  readonly attribute unsigned short <a href="#dom-xmlhttprequest-readystate" title=dom-XMLHttpRequest-readyState>readyState</a>;

  // <a href="#request">request</a>
  void <a href="#dom-xmlhttprequest-open" title=dom-XMLHttpRequest-open>open</a>(DOMString <var>method</var>, DOMString <var title="">url</var>);
  void <a href="#dom-xmlhttprequest-open" title=dom-XMLHttpRequest-open>open</a>(DOMString <var>method</var>, DOMString <var title="">url</var>, boolean <var>async</var>);
  void <a href="#dom-xmlhttprequest-open" title=dom-XMLHttpRequest-open>open</a>(DOMString <var>method</var>, DOMString <var title="">url</var>, boolean <var>async</var>, DOMString? <var>user</var>);
  void <a href="#dom-xmlhttprequest-open" title=dom-XMLHttpRequest-open>open</a>(DOMString <var>method</var>, DOMString <var title="">url</var>, boolean <var>async</var>, DOMString? <var>user</var>, DOMString? <var>password</var>);
  void <a href="#dom-xmlhttprequest-setrequestheader" title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader</a>(DOMString <var>header</var>, DOMString <var>value</var>);
  void <a href="#dom-xmlhttprequest-send" title=dom-XMLHttpRequest-send>send</a>();
  void <a href="#dom-xmlhttprequest-send" title=dom-XMLHttpRequest-send>send</a>(Document <var>data</var>);
  void <a href="#dom-xmlhttprequest-send" title=dom-XMLHttpRequest-send>send</a>([AllowAny] DOMString? <var>data</var>);
  void <a href="#dom-xmlhttprequest-abort" title=dom-XMLHttpRequest-abort>abort</a>();

  // <a href="#response">response</a>
  readonly attribute unsigned short <a href="#dom-xmlhttprequest-status" title=dom-XMLHttpRequest-status>status</a>;
  readonly attribute DOMString <a href="#dom-xmlhttprequest-statustext" title=dom-XMLHttpRequest-statusText>statusText</a>;
  DOMString <a href="#dom-xmlhttprequest-getresponseheader" title=dom-XMLHttpRequest-getResponseHeader>getResponseHeader</a>(DOMString <var>header</var>);
  DOMString <span title=dom-XMLHttpRequest-getAllResponseHeaders>getAllResponseHeaders</span>();
  readonly attribute DOMString <a href="#dom-xmlhttprequest-responsetext" title=dom-XMLHttpRequest-responseText>responseText</a>;
  readonly attribute Document <a href="#dom-xmlhttprequest-responsexml" title=dom-XMLHttpRequest-responseXML>responseXML</a>;
};</pre>

  <h3 id=origin-and-base-url><span class=secno>3.1. </span>Origin and Base
   URL</h3>

  <p>Each <a href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object
   has an associated <dfn
   id=xmlhttprequest-origin><code>XMLHttpRequest</code> origin</dfn> and an
   <dfn id=xmlhttprequest-base-url><code>XMLHttpRequest</code> base
   URL</dfn>.

  <p>This specification defines their values when the global object is
   represented by the <code>Window</code> object. When the <a
   href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object is used in
   other contexts their values will have to be defined as appropriate for
   that context. That is considered to be out of scope for this
   specification.

  <p>In environments where the global object is represented by the
   <code>Window</code> object the <a
   href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object has an
   associated <dfn id=xmlhttprequest-document><code>XMLHttpRequest</code>
   <code>Document</code></dfn> which is the <code>Document</code> object
   associated with the <code>Window</code> object for which the <a
   href="#xmlhttprequest"><code>XMLHttpRequest</code></a> interface object
   was created.

  <p class=note>The <a
   href="#xmlhttprequest-document"><code>XMLHttpRequest</code>
   <code>Document</code></a> is used to determine the <a
   href="#xmlhttprequest-origin"><code>XMLHttpRequest</code> origin</a> and
   <a href="#xmlhttprequest-base-url"><code>XMLHttpRequest</code> base
   URL</a> at a later stage.

  <h3 id=task-sources><span class=secno>3.2. </span>Task Sources</h3>

  <p>The <a href="#task-source">task source</a> used by this specification is
   the <dfn id=xmlhttprequest-task-source><code>XMLHttpRequest</code> task
   source</dfn>.

  <h3 id=constructors><span class=secno>3.3. </span>Constructors</h3>

  <dl class=domintro>
   <dt><var title="">client</var> = new <a href="#dom-xmlhttprequest"><code
    title=dom-XMLHttpRequest>XMLHttpRequest</code></a>()

   <dd>Returns a new <a
    href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object.
  </dl>

  <p>When the <dfn id=dom-xmlhttprequest
   title=dom-XMLHttpRequest><code>XMLHttpRequest()</code></dfn> constructor
   is invoked, the user agent <em class=ct>must</em> return a new <a
   href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object.

  <h3 id=event-handler-attributes><span class=secno>3.4. </span>Event Handler
   Attributes</h3>

  <p>The following is the <a href="#event-handler-attributes-0" title="event
   handler attributes">event handler attribute</a> (and its corresponding <a
   href="#event-handler-event-type">event handler event type</a>) that <em
   class=ct>must</em> be supported as DOM attribute by the <a
   href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object:

  <table>
   <thead>
    <tr>
     <th><a href="#event-handler-attributes-0" title="event handler
      attributes">event handler attribute</a>

     <th><a href="#event-handler-event-type">event handler event type</a>

   <tbody>
    <tr>
     <td><dfn id=handler-xhr-onreadystatechange
      title=handler-xhr-onreadystatechange><code>onreadystatechange</code></dfn>


     <td><code title=event-xhr-readystatechange>readystatechange</code>
  </table>

  <h3 id=states><span class=secno>3.5. </span>States</h3>

  <dl class=domintro>
   <dt><var title="">client</var> . <a
    href="#dom-xmlhttprequest-readystate"><code
    title=dom-XMLHttpRequest-readyState>readyState</code></a>

   <dd>
    <p>Returns the current state.
  </dl>

  <p>The <a href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object can
   be in several states. The <dfn id=dom-xmlhttprequest-readystate
   title=dom-XMLHttpRequest-readyState><code>readyState</code></dfn>
   attribute <em class=ct>must</em> return the current state, which <em
   class=ct>must</em> be one of the following values:

  <dl>
   <dt><dfn id=dom-xmlhttprequest-unsent
    title=dom-XMLHttpRequest-UNSENT><code>UNSENT</code></dfn> (numeric value
    0)

   <dd>
    <p>The object has been constructed.

   <dt><dfn id=dom-xmlhttprequest-opened
    title=dom-XMLHttpRequest-OPENED><code>OPENED</code></dfn> (numeric value
    1)

   <dd>
    <p>The <a href="#dom-xmlhttprequest-open"><code
     title=dom-XMLHttpRequest-open>open()</code></a> method has been
     successfully invoked. During this state request headers can be set using
     <a href="#dom-xmlhttprequest-setrequestheader"><code
     title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader()</code></a>
     and the request can be made using the <a
     href="#dom-xmlhttprequest-send"><code
     title=dom-XMLHttpRequest-send>send()</code></a> method.

   <dt><dfn id="dom-xmlhttprequest-headers_received"
    title="dom-XMLHttpRequest-HEADERS_RECEIVED"><code>HEADERS_RECEIVED</code></dfn>
    (numeric value 2)

   <dd>
    <p>All redirects (if any) have been followed and all HTTP headers of the
     final response have been received. Several response members of the
     object are now available.

   <dt><dfn id=dom-xmlhttprequest-loading
    title=dom-XMLHttpRequest-LOADING><code>LOADING</code></dfn> (numeric
    value 3)

   <dd>
    <p>The <a href="#response-entity-body">response entity body</a> is being
     received.

   <dt><dfn id=dom-xmlhttprequest-done
    title=dom-XMLHttpRequest-DONE><code>DONE</code></dfn> (numeric value 4)

   <dd>
    <p>The data transfer has been completed or something went wrong during
     the transfer (e.g. infinite redirects).
  </dl>

  <p>The <a href="#dom-xmlhttprequest-opened"
   title=dom-XMLHttpRequest-OPENED>OPENED</a> state has an associated <dfn
   id=send-flag><code>send()</code> flag</dfn> that indicates whether the <a
   href="#dom-xmlhttprequest-send"><code
   title=dom-XMLHttpRequest-send>send()</code></a> method has been invoked.
   It can be either true or false and has an initial value of false.

  <p>The <a href="#dom-xmlhttprequest-done"
   title=dom-XMLHttpRequest-DONE>DONE</a> state has an associated <dfn
   id=error-flag>error flag</dfn> that indicates some type of network error
   or abortion. It can be either true or false and has an initial value of
   false.

  <h3 id=request><span class=secno>3.6. </span>Request</h3>

  <p>The <a href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object
   holds the following request metadata variables:

  <dl>
   <dt>The <dfn id=asynchronous-flag>asynchronous flag</dfn>

   <dd>True when <a href="#fetch" title=fetch>fetching</a> is done
    asychronously. False when fetching is done synchronously.

   <dt>The <dfn id=request-method>request method</dfn>

   <dd>The method used in the request.

   <dt>The <dfn id=request-url>request URL</dfn>

   <dd>The <a href="#url">URL</a> used in the request.

   <dt>The <dfn id=request-username>request username</dfn>

   <dd>The username used in the request or null if there is no username.

   <dt>The <dfn id=request-password>request password</dfn>

   <dd>The password used in the request or null if there is no password.

   <dt>The <dfn id=author-request-headers>author request headers</dfn>

   <dd>A list consisting of HTTP header name/value pairs to be used in the
    request.

   <dt>The <dfn id=request-entity-body>request entity body</dfn>

   <dd>The <a href="#entity-body">entity body</a> used in the request.
  </dl>

  <h4 id=the-open-method><span class=secno>3.6.1. </span>The <code
   title="">open()</code> method</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <a href="#dom-xmlhttprequest-open"><code
    title=dom-XMLHttpRequest-open>open(<var title="">method</var>, <var
    title="">url</var>, <var title="">async</var>, <var title="">user</var>,
    <var title="">password</var>)</code></a>

   <dd>
    <p>Sets the <a href="#request-method">request method</a>, <a
     href="#request-url">request URL</a>, <a
     href="#asynchronous-flag">asynchronous flag</a>, <a
     href="#request-username">request username</a>, and <a
     href="#request-password">request password</a>.</p>

    <p>Throws a <code>SYNTAX_ERR</code> exception if one of the following is
     true:</p>

    <ul>
     <li><var title="">method</var> is not a valid HTTP method.

     <li><var title="">url</var> cannot be resolved.

     <li><var title="">url</var> contains the <code>"user:password"</code>
      format in the <a href="#userinfo"><code>userinfo</code></a> production.
    </ul>

    <p>Throws a <a href="#security-err"><code>SECURITY_ERR</code></a>
     exception if <var title="">method</var> is a case-insensitive match for
     <code>CONNECT</code>, <code>TRACE</code> or <code>TRACK</code>.</p>

    <p>Throws a <a href="#security-err"><code>SECURITY_ERR</code></a>
     exception if the <a href="#origin">origin</a> of <var title="">url</var>
     does not match the <a
     href="#xmlhttprequest-origin"><code>XMLHttpRequest</code> origin</a>.</p>

    <p>Throws a <code>NOT_SUPPORTED_ERR</code> exception if the <a
     href="#url-scheme"><code>&lt;scheme></code></a> of <var
     title="">url</var> is not supported.</p>
  </dl>

  <p>When the <dfn id=dom-xmlhttprequest-open
   title=dom-XMLHttpRequest-open><code>open(<var title="">method</var>, <var
   title="">url</var>, <var title="">async</var>, <var title="">user</var>,
   <var title="">password</var>)</code></dfn> method is invoked, the user
   agent <em class=ct>must</em> run these steps (unless otherwise indicated):

  <ol>
   <li>
    <p>If the <a href="#xmlhttprequest"><code>XMLHttpRequest</code></a>
     object has an associated <a
     href="#xmlhttprequest-document"><code>XMLHttpRequest</code>
     <code>Document</code></a> run these substeps:</p>

    <ol>
     <li>
      <p>If the <a
       href="#xmlhttprequest-document"><code>XMLHttpRequest</code>
       <code>Document</code></a> is not <a href="#fully-active">fully
       active</a> raise an <code>INVALID_STATE_ERR</code> exception and
       terminate the overall set of steps.

     <li>
      <p>Let <a href="#xmlhttprequest-base-url"><code>XMLHttpRequest</code>
       base URL</a> be the <a href="#document-base-url">document base URL</a>
       of the <a href="#xmlhttprequest-document"><code>XMLHttpRequest</code>
       <code>Document</code></a>.

     <li>
      <p>Let <a href="#xmlhttprequest-origin"><code>XMLHttpRequest</code>
       origin</a> be the <a href="#origin">origin</a> of the <a
       href="#xmlhttprequest-document"><code>XMLHttpRequest</code>
       <code>Document</code></a>.
    </ol>

   <li>
    <p>If any code point in <var>method</var> is higher than U+00FF LATIN
     SMALL LETTER Y WITH DIAERESIS or after <span title="deflate a DOMString
     into an byte sequence">deflating</span> <var>method</var> it does not
     match the <a href="#method-token">Method token</a> production raise a
     <code>SYNTAX_ERR</code> exception and terminate these steps. Otherwise
     let <var>method</var> be the result of <span title="deflate a DOMString
     into an byte sequence">deflating</span> <var>method</var>.
   </li>
   <!-- This sounds lame, but it works. -->

   <li>
    <p>If <var>method</var> is a case-insensitive match for
     <code>CONNECT</code>, <code>DELETE</code>, <code>GET</code>,
     <code>HEAD</code>, <code>OPTIONS</code>, <code>POST</code>,
     <code>PUT</code>, <code>TRACE</code>, or <code>TRACK</code> subtract
     0x20 from each byte in the range 0x61 (ASCII a) to 0x7A (ASCII z).</p>

    <p class=note>If it does not match any of the above, it is passed through
     <em>literally</em>, including in the final request.</p>
   </li>
   <!-- WebKit (and supposedly Gecko) also uppercase: COPY, INDEX, LOCK,
   M-POST, MKCOL, MOVE, PROPFIND, PROPPATCH, and UNLOCK. -->

   <li>
    <p>If <var>method</var> is a case-sensitive match for
     <code>CONNECT</code>, <code>TRACE</code>, or <code>TRACK</code> raise a
     <a href="#security-err"><code>SECURITY_ERR</code></a> exception and
     terminate these steps.</p>

    <p class=note>Allowing these methods poses a security risk. [<cite><a
     href="#ref-httpverbsec">HTTPVERBSEC</a></cite>]</p>

   <li>
    <p>Let <var title="">url</var> be a <a href="#url">URL</a>.

   <li>
    <p>Let <a href="#url-character-encoding">URL character encoding</a> of
     <var title="">url</var> be UTF-8.

   <li>
    <p><a href="#resolve-a-url" title="Resolve a URL">Resolve</a> <var
     title="">url</var> relative to the <a
     href="#xmlhttprequest-base-url"><code>XMLHttpRequest</code> base
     URL</a>. If the algorithm returns an error raise a
     <code>SYNTAX_ERR</code> exception and terminate these steps.
   </li>
   <!-- Presto and Gecko override the encoding. WebKit does not. Trident
   does not support non-ASCII URLs. This matters for the <query> component,
   see HTML5. -->

   <li>
    <p>Drop <a href="#url-fragment"><code>&lt;fragment></code></a> from <var
     title="">url</var>.

   <li>
    <p>If <var title="">url</var> contains an unsupported <a
     href="#url-scheme"><code>&lt;scheme></code></a> raise a
     <code>NOT_SUPPORTED_ERR</code> and terminate these steps.

   <li>
    <p>If the <code>"user:password"</code> format in the <a
     href="#userinfo"><code>userinfo</code></a> production is not supported
     for the relevant scheme and <var title="">url</var> contains this format
     raise a <code>SYNTAX_ERR</code> and terminate these steps.

   <li>
    <p>If <var title="">url</var> contains the <code>"user:password"</code>
     format let <var>temp user</var> be the user part and <var>temp
     password</var> be the password part.

   <li>
    <p>If <var title="">url</var> just contains the <code>"user"</code>
     format let <var>temp user</var> be the user part.

   <li>
    <p>If the <a href="#origin">origin</a> of <var title="">url</var> is not
     <a href="#same-origin">same origin</a> with the <a
     href="#xmlhttprequest-origin"><code>XMLHttpRequest</code> origin</a>
     raise a <a href="#security-err"><code>SECURITY_ERR</code></a> exception
     and terminate these steps.

   <li>
    <p>Let <var>async</var> be the value of the <var>async</var> argument or
     true if it was omitted.

   <li>
    <p>If the <var>user</var> argument was not omitted follow these sub
     steps:</p>

    <ol>
     <li>
      <p>If <var>user</var> is null let <var>temp user</var> be null.

     <li>
      <p>Otherwise let <var>temp user</var> be <var>user</var>.
    </ol>

    <p class=note>These steps override anything that may have been set by the
     <var title="">url</var> argument.</p>

   <li>
    <p>If the <var>password</var> argument was not omitted follow these sub
     steps:</p>

    <ol>
     <li>
      <p>If <var>password</var> is null let <var>temp password</var> be null.

     <li>
      <p>Otherwise let <var>temp password</var> be <var>password</var>.
    </ol>

    <p class=note>These steps override anything that may have been set by the
     <var title="">url</var> argument.</p>

   <li>
    <p><a href="#abort-send-algorithm" title="abort send()">Abort the
     <code>send()</code> algorithm</a>.

   <li>
    <p>The user agent <em class=ct>should</em> cancel any network activity
     for which the object is responsible.
   </li>
   <!-- we can hardly require it... -->

   <li>
    <p>If there are any <a href="#task" title=task>tasks</a> from the
     object's <a
     href="#xmlhttprequest-task-source"><code>XMLHttpRequest</code> task
     source</a> in one of the <a href="#task-queues">task queues</a>, then
     remove those tasks.

   <li>
    <p>Set variables associated with the object as follows:</p>

    <ul>
     <li>
      <p>Set the <a href="#send-flag"><code>send()</code> flag</a> to false.

     <li>
      <p>Set <a href="#response-entity-body">response entity body</a> to
       null.

     <li>
      <p>Empty the list of <a href="#author-request-headers">author request
       headers</a>.</p>

     <li>
      <p>Set the <a href="#request-method">request method</a> to
       <var>method</var>.

     <li>
      <p>Set the <a href="#request-url">request URL</a> to <var
       title="">url</var>.

     <li>
      <p>Set the <a href="#request-username">request username</a> to
       <var>temp user</var>.

     <li>
      <p>Set the <a href="#request-password">request password</a> to
       <var>temp password</var>.

     <li>
      <p>Set the <a href="#asynchronous-flag">asynchronous flag</a> to the
       value of <var>async</var>.
    </ul>

   <li>
    <p>Switch the the state to <a href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a>.

   <li>
    <p><a href="#dispatch-readystatechange-event">Dispatch a
     <code>readystatechange</code> event</a>.
  </ol>

  <h4 id=the-setrequestheader-method><span class=secno>3.6.2. </span>The
   <code title="">setRequestHeader()</code> method</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <a
    href="#dom-xmlhttprequest-setrequestheader"><code
    title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader(<var
    title="">header</var>, <var title="">value</var>)</code></a>

   <dd>
    <p>Appends an header to the list of <a
     href="#author-request-headers">author request headers</a> or if the
     header is already in the <a href="#author-request-headers">author
     request headers</a> its value appended to.</p>

    <p>Throws an <code>INVALID_STATE_ERR</code> exception if the state is not
     <a href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a> or if the <a
     href="#send-flag"><code>send()</code> flag</a> is true.</p>

    <p>Throws a <code>SYNTAX_ERR</code> exception if <var
     title="">header</var> is not a valid HTTP header field name or if <var
     title="">value</var> is not a valid HTTP header field value.</p>
  </dl>

  <p class=note>As indicated in the algorithm below certain headers cannot be
   set and are left up to the user agent. In addition there are certain other
   headers the user agent will take control of if they are not set by the
   author as indicated at the end of the <a
   href="#dom-xmlhttprequest-send"><code
   title=dom-XMLHttpRequest-send>send()</code></a> method section.

  <p>When the <dfn id=dom-xmlhttprequest-setrequestheader
   title=dom-XMLHttpRequest-setRequestHeader><code>setRequestHeader(<var
   title="">header</var>, <var title="">value</var>)</code></dfn> method is
   invoked, the user agent <em class=ct>must</em> run these steps:

  <ol>
   <li>
    <p>If the state is not <a href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a> raise an
     <code>INVALID_STATE_ERR</code> exception and terminate these steps.

   <li>
    <p>If the <a href="#send-flag"><code>send()</code> flag</a> is true raise
     an <code>INVALID_STATE_ERR</code> exception and terminate these steps.

   <li>
    <p>If any code point in <var>header</var> is higher than U+00FF LATIN
     SMALL LETTER Y WITH DIAERESIS or after <span title="deflate a DOMString
     into an byte sequence">deflating</span> <var>header</var> it does not
     match the <a href="#field-name">field-name</a> production raise a
     <code>SYNTAX_ERR</code> exception and terminate these steps. Otherwise
     let <var>header</var> be the result of <span title="deflate a DOMString
     into an byte sequence">deflating</span> <var>header</var>.
   </li>
   <!-- This sounds lame, but it works. -->

   <li>
    <p>If any code point in <var>value</var> is higher than U+00FF LATIN
     SMALL LETTER Y WITH DIAERESIS or after <span title="deflate a DOMString
     into an byte sequence">deflating</span> <var>value</var> it does not
     match the <a href="#field-value">field-value</a> production raise a
     <code>SYNTAX_ERR</code> exception and terminate these steps. Otherwise
     let <var>value</var> be the result of <span title="deflate a DOMString
     into an byte sequence">deflating</span> <var>value</var>.</p>
    <!-- This sounds lame, but it works. -->
    <p class=note>The empty string is legal and represents the empty header
     value.</p>

   <li>
    <p>Terminate these steps if <var>header</var> is a case-insensitive match
     for one of the following headers:</p>

    <ul>
     <li><code>Accept-Charset</code>

     <li><code>Accept-Encoding</code>

     <li><code>Connection</code>

     <li><code>Content-Length</code>

     <li><code>Cookie</code>

     <li><code>Cookie2</code>

     <li><code>Content-Transfer-Encoding</code>

     <li><code>Date</code>

     <li><code>Expect</code>

     <li><code>Host</code>

     <li><code>Keep-Alive</code>

     <li><code>Referer</code>

     <li><code>TE</code>

     <li><code>Trailer</code>

     <li><code>Transfer-Encoding</code>

     <li><code>Upgrade</code>

     <li><code>User-Agent</code>

     <li><code>Via</code>
    </ul>

    <p>&hellip; or if the start of <var>header</var> is a case-insensitive
     match for <code>Proxy-</code> or <code>Sec-</code> (including when
     <var>header</var> is just <code>Proxy-</code> or <code>Sec-</code>).</p>

    <p class=note>The above headers are controlled by the user agent to let
     it control those aspects of transport. This guarantees data integrity to
     some extent. Header names starting with <code>Sec-</code> are not
     allowed to be set to allow new headers to be minted that are guaranteed
     not to come from <a
     href="#xmlhttprequest"><code>XMLHttpRequest</code></a>.</p>

   <li>
    <p>If <var>header</var> is not in the <a
     href="#author-request-headers">author request headers</a> list append
     <var>header</var> with its associated <var>value</var> to the list and
     terminate these steps.

   <li>
    <p>If <var>header</var> is in the <a
     href="#author-request-headers">author request headers</a> list either
     use multiple headers, combine the values or use a combination of those
     (section 4.2, RFC 2616). [<cite><a
     href="#rfc-rfc2616">RFC2616</a></cite>]
   </li>
   <!-- XXX it seems UAs always combine the values -->
  </ol>

  <p class=note>See also the <a href="#dom-xmlhttprequest-send"><code
   title=dom-XMLHttpRequest-send>send()</code></a> method regarding user
   agent header handling for caching, authentication, proxies, and cookies.

  <div class=example>
   <pre><code>// The following script:
var client = new XMLHttpRequest();
client.open('GET', 'demo.cgi');
client.setRequestHeader('X-Test', 'one');
client.setRequestHeader('X-Test', 'two');
client.send();

// ...would result in the following header being sent:
...
X-Test: one, two
...</code></pre>
  </div>

  <h4 id=the-send-method><span class=secno>3.6.3. </span>The <code
   title="">send()</code> method</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <a href="#dom-xmlhttprequest-send"><code
    title=dom-XMLHttpRequest-send>send(<var title="">data</var>)</code></a>

   <dd>
    <p>Initiates the request. The optional argument provides the <a
     href="#request-entity-body">request entity body</a>. The argument is
     ignored if <a href="#request-method">request method</a> is
     <code>GET</code> or <code>HEAD</code>.</p>

    <p>Throws an <code>INVALID_STATE_ERR</code> exception if the state is not
     <a href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a> or if the <a
     href="#send-flag"><code>send()</code> flag</a> is true.</p>
  </dl>

  <p>When the <dfn id=dom-xmlhttprequest-send
   title=dom-XMLHttpRequest-send><code>send(<var>data</var>)</code></dfn>
   method is invoked, the user agent <em class=ct>must</em> run the following
   steps (unless otherwise noted). This algorithm gets aborted when the <a
   href="#dom-xmlhttprequest-open"><code
   title=dom-XMLHttpRequest-open>open()</code></a> or <a
   href="#dom-xmlhttprequest-abort"><code
   title=dom-XMLHttpRequest-abort>abort()</code></a> method is invoked. When
   the <dfn id=abort-send-algorithm title="abort send()"><code>send()</code>
   algorithm is aborted</dfn> the user agent <em class=ct>must</em> terminate
   the algorithm after finishing the step it is on.

  <p class=note>The <code title="">send()</code> algorithm can only be
   aborted when the <a href="#asynchronous-flag">asynchronous flag</a> is
   true and only after the method call has returned.

  <ol>
   <li>
    <p>If the state is not <a href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a> raise an
     <code>INVALID_STATE_ERR</code> exception and terminate these steps.

   <li>
    <p>If the <a href="#send-flag"><code>send()</code> flag</a> is true raise
     an <code>INVALID_STATE_ERR</code> exception and terminate these steps.

   <li>
    <p>If the <a href="#request-method">request method</a> is a
     case-sensitive match for <code>GET</code> or <code>HEAD</code> act as if
     <var title="">data</var> is null.</p>

    <p>If the <var>data</var> argument has been omitted or is null, do not
     include a <a href="#request-entity-body">request entity body</a> and go
     to the next step.</p>

    <p>Otherwise, let <var>encoding</var> be null, <var>mime type</var> be
     null, and then follow these rules:</p>

    <dl class=switch>
     <dt>If <var>data</var> is a <code>Document</code>

     <dd>
      <p>Let <var>encoding</var> be the <a
       href="#preferred-mime-name">preferred MIME name</a> of the <a
       href="#document-character-encoding" title="document's character
       encoding">character encoding</a> of <var>data</var>. If
       <var>encoding</var> is UTF-16 change it to UTF-8.</p>

      <p>Let <var>mime type</var> be "<code>application/xml;charset=</code>"
       followed by <var>encoding</var>.</p>

      <p>Let the <a href="#request-entity-body">request entity body</a> be
       the result of getting the <a href="#dom-innerhtml"><code
       title=dom-innerHTML>innerHTML</code></a> attribute on <var>data</var>
       <a href="#dfn-obtain-unicode" title="convert a DOMString to a sequence
       of Unicode characters">converted to Unicode</a> and encoded as
       <var>encoding</var>. Re-raise any exception this raises.</p>

      <p class=note>In particular, if the document cannot be serialized an
       <code>INVALID_STATE_ERR</code> exception is raised.</p>

      <p class=note>Subsequent changes to the <code>Document</code> have no
       effect on what is submitted.</p>

     <dt>If <var>data</var> is a <code>DOMString</code>

     <dd>
      <p>Let <var>encoding</var> be UTF-8.</p>

      <p>Let <var>mime type</var> be "<code>text/plain;charset=UTF-8</code>".</p>

      <p>Let the <a href="#request-entity-body">request entity body</a> be
       <var>data</var> <a href="#dfn-obtain-unicode" title="convert a
       DOMString to a sequence of Unicode characters">converted to
       Unicode</a> and encoded as UTF-8.</p>
    </dl>

    <p>If a <code>Content-Type</code> header is set using <a
     href="#dom-xmlhttprequest-setrequestheader"><code
     title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader()</code></a>
     whose value is a <a href="#valid-mime-type">valid MIME type</a> and has
     a <code>charset</code> parameter whose value is not a case-insensitive
     match for <var title="">encoding</var>, and <var title="">encoding</var>
     is not null, set all the <code>charset</code> parameters of the
     <code>Content-Type</code> header to <var title="">encoding</var>.</p>

    <p>If no <code>Content-Type</code> header has been set using <a
     href="#dom-xmlhttprequest-setrequestheader"><code
     title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader()</code></a>
     and <var title="">mime type</var> is not null set a
     <code>Content-Type</code> request header with as value <var
     title="">mime type</var>.</p>
    <!-- reminder: if we ever change this to always include charset it has
    to be included as the first parameter for compatibility reasons -->


   <li>
    <p>If the <a href="#asynchronous-flag">asynchronous flag</a> is false
     release the <a href="#storage-mutex">storage mutex</a>.

   <li>
    <p>Set the <a href="#error-flag">error flag</a> to false.

   <li>
    <p>If the <a href="#asynchronous-flag">asynchronous flag</a> is true run
     these substeps:</p>

    <ol>
     <li>
      <p>Set the <a href="#send-flag"><code>send()</code> flag</a> to true.

     <li>
      <p><a href="#dispatch-readystatechange-event">Dispatch a
       <code>readystatechange</code> event</a>.</p>

      <p class=note>The state does not change. The event is dispatched for
       historical reasons.</p>

     <li>
      <p>Return the <a href="#dom-xmlhttprequest-send"><code
       title=dom-XMLHttpRequest-send>send()</code></a> method call, but
       continue running the steps in this algorithm.
    </ol>

   <li>
    <p><a href="#fetch">Fetch</a> the <a href="#request-url">request URL</a>
     from <i title="">origin</i> <a
     href="#xmlhttprequest-origin"><code>XMLHttpRequest</code> origin</a>,
     with the <i title="">synchronous flag</i> set if the <a
     href="#asynchronous-flag">asynchronous flag</a> is false, using HTTP
     method <a href="#request-method">request method</a>, user <a
     href="#request-username">request username</a> (if non-null) and password
     <a href="#request-password">request password</a> (if non-null), taking
     into account the <a href="#request-entity-body">request entity body</a>,
     list of <a href="#author-request-headers">author request headers</a> and
     the rules listed at the end of this section.</p>

    <dl class=switch>
     <dt>If the <a href="#asynchronous-flag">asynchronous flag</a> is false

     <dd>
      <p>While making the request also follow the <a
       href="#same-origin-request-event-rules">same-origin request event
       rules</a>.</p>
      <!--
         This cannot involve any task queue whatsoever because that would
         mean other tasks on the task queue might get processed as well
         which is counter to the whole idea of doing things synchronous.
        -->

      <p class=note>The <a href="#dom-xmlhttprequest-send"><code
       title=dom-XMLHttpRequest-send>send()</code></a> method call will now
       be returned by virtue of this algorithm ending.</p>

     <dt>If the <a href="#asynchronous-flag">asynchronous flag</a> is true

     <dd>
      <p><span>Make progress notifications</span>.</p>

      <p><span>Make upload progress notifications</span>.</p>

      <p>While processing the request, as data becomes available and when the
       user interferes with the request, <a href="#queue-a-task" title="queue
       a task">queue tasks</a> to update the <a
       href="#response-entity-body">response entity body</a> and follow the
       <a href="#same-origin-request-event-rules">same-origin request event
       rules</a>.</p>
    </dl>
  </ol>

  <hr>

  <p>If the user agent allows the end user to configure a proxy it <em
   class=ct>should</em> modify the request appropriately; i.e., connect to
   the proxy host instead of the origin server, modify the
   <code>Request-Line</code> and send <code>Proxy-Authorization</code>
   headers as specified.

  <hr>

  <p>If the user agent supports HTTP Authentication and <code
   title=http-authorization>Authorization</code> is not in the list of <a
   href="#author-request-headers">author request headers</a>, it <em
   class=ct>should</em> consider requests originating from the <a
   href="#xmlhttprequest"><code>XMLHttpRequest</code></a> object to be part
   of the protection space that includes the accessed URIs and send <code
   title=http-authorization>Authorization</code> headers and handle <code>401
   Unauthorized</code> requests appropriately.

  <p>If authentication fails, <code
   title=http-authorization>Authorization</code> is not in the list of <a
   href="#author-request-headers">author request headers</a>, <a
   href="#request-username">request username</a> is null, and <a
   href="#request-password">request password</a> is null, user agents <em
   class=ct>should</em> prompt the end user for their username and password.

  <p>If authentication fails, <code
   title=http-authorization>Authorization</code> is not in the list of <a
   href="#author-request-headers">author request headers</a>, <a
   href="#request-username">request username</a> is non-null, and <a
   href="#request-password">request password</a> is non-null, user agents <em
   class=ct>must not</em> prompt the end user for their username and
   password. [<cite><a href="#ref-rfc2617">RFC2617</a></cite>]

  <p class=note>End users are not prompted if username/password are provided
   through the <a href="#dom-xmlhttprequest-open"><code
   title=dom-XMLHttpRequest-open>open()</code></a> API so that authors can
   implement their own user interface.

  <hr>

  <p>If the user agent supports HTTP State Management it <em
   class=ct>should</em> persist, discard and send cookies (as received in the
   <code>Set-Cookie</code> and <code>Set-Cookie2</code> response headers, and
   sent in the <code>Cookie</code> header) as applicable. [<cite><a
   href="#ref-cookies">COOKIES</a></cite>]

  <hr>

  <p>If the user agent implements a HTTP cache it <em class=ct>should</em>
   respect <code>Cache-Control</code> request headers set by the <a
   href="#dom-xmlhttprequest-setrequestheader"><code
   title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader()</code></a>
   (e.g., <code>Cache-Control: no-cache</code> bypasses the cache). It <em
   class=ct>must not</em> send <code>Cache-Control</code> or
   <code>Pragma</code> request headers automatically unless the end user
   explicitly requests such behavior (e.g. by reloading the page).

  <p>For <code>304 Not Modified</code> responses that are a result of a user
   agent generated conditional request the user agent <em class=ct>must</em>
   act as if the server gave a <code>200 OK</code> response with the
   appropriate content. The user agent <em class=ct>must</em> allow <a
   href="#dom-xmlhttprequest-setrequestheader"><code
   title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader()</code></a> to
   override automatic cache validation by setting request headers (e.g.
   <code>If-None-Match</code> or <code>If-Modified-Since</code>), in which
   case <code>304 Not Modified</code> responses <em class=ct>must</em> be
   passed through. [<cite><a href="#rfc-rfc2616">RFC2616</a></cite>]

  <hr>

  <p>If the user agent implements server-driven content-negotiation it <em
   class=ct>should</em> set <code>Accept-Encoding</code> and
   <code>Accept-Charset</code> headers as appropriate. For
   <code>Accept</code> and <code>Accept-Language</code> the user agent <em
   class=ct>must</em> follow these constraints:

  <ul>
   <li>
    <p>Both headers <em class=ct>must not</em> be modified if they are
     already set through <a href="#dom-xmlhttprequest-setrequestheader"><code
     title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader()</code></a>.

   <li>
    <p>If not set through <a
     href="#dom-xmlhttprequest-setrequestheader"><code
     title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader()</code></a>
     <code>Accept-Language</code> <em class=ct>should</em> be set as
     appropriate.

   <li>
    <p>If not set through <a
     href="#dom-xmlhttprequest-setrequestheader"><code
     title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader()</code></a>
     <code>Accept</code> <em class=ct>must</em> be set with as value
     <code>*/*</code>.
  </ul>

  <p>Responses <em class=ct>must</em> have the content-encodings
   automatically decoded. [<cite><a href="#rfc-rfc2616">RFC2616</a></cite>]

  <hr>

  <p>Besides the <a href="#author-request-headers">author request headers</a>
   user agents <em class=ct>should not</em> include additional request
   headers other than those mentioned above or other than those authors are
   not allowed to set using <a
   href="#dom-xmlhttprequest-setrequestheader"><code
   title=dom-XMLHttpRequest-setRequestHeader>setRequestHeader()</code></a>.
   This ensures that authors have a reasonably predictable API.

  <h4 id=infrastructure-for-the-send-method><span class=secno>3.6.4.
   </span>Infrastructure for the <code title="">send()</code> method</h4>

  <p>The <dfn id=same-origin-request-event-rules>same-origin request event
   rules</dfn> are as follows:

  <dl class=switch>
   <dt>If the response has an HTTP status code of 301, 302, 303, or 307

   <dd>
    <p>If the <a href="#origin">origin</a> of the <a href="#url">URL</a>
     conveyed by the <code title=http-location>Location</code> header is <a
     href="#same-origin">same origin</a> with the <a
     href="#xmlhttprequest-origin"><code>XMLHttpRequest</code> origin</a> and
     the redirect does not violate infinite loop precautions, transparently
     follow the redirect while observing the <a
     href="#same-origin-request-event-rules">same-origin request event
     rules</a>.</p>

    <p>Otherwise, this is a <a href="#network-error">network error</a>.</p>

    <p class=note>HTTP places requirements on the user agent regarding the
     preservation of the <a href="#request-method">request method</a> and <a
     href="#request-entity-body">request entity body</a> during redirects,
     and also requires end users to be notified of certain kinds of automatic
     redirections.</p>
    <!-- XXX HTTP needs fixing here -->

   <dt>If the end user cancels the request

   <dd>
    <p>This is an <a href="#abort-error">abort error</a>.

   <dt>If there is a network error

   <dd>
    <p>In case of DNS errors, TLS negotiation failure, or other type of
     network errors, this is a <a href="#network-error">network error</a>. Do
     not request any kind of end user interaction.</p>

    <p class=note>This does not include HTTP responses that indicate some
     type of error, such as HTTP status code 410.</p>

   <dt>Once all HTTP headers have been received and the <a
    href="#asynchronous-flag">asynchronous flag</a> is true (and this is not
    an HTTP redirect)

   <dd>
    <p><a href="#switch-headers-received">Switch to the HEADERS_RECEIVED
     state</a>.

   <dt>Once the first byte (or more) of the <a
    href="#response-entity-body">response entity body</a> has been received
    and the <a href="#asynchronous-flag">asynchronous flag</a> is true

   <dt>If there is no <a href="#response-entity-body">response entity
    body</a> and the <a href="#asynchronous-flag">asynchronous flag</a> is
    true

   <dd>
    <p><a href="#switch-loading">Switch to the LOADING state</a>.

   <dt>Once the whole <a href="#response-entity-body">response entity
    body</a> has been received

   <dt>If there is no <a href="#response-entity-body">response entity
    body</a> and the <a href="#asynchronous-flag">asynchronous flag</a> is
    false or the state is <a href="#dom-xmlhttprequest-loading"
    title=dom-XMLHttpRequest-LOADING>LOADING</a>

   <dd>
    <p><a href="#switch-done">Switch to the DONE state</a>.
  </dl>

  <hr>

  <p>When something is said to be a <dfn id=network-error>network error</dfn>
   run the <a href="#request-error">request error</a> steps for exception <a
   href="#network-err"><code>NETWORK_ERR</code></a>.

  <p>When something is said to be an <dfn id=abort-error>abort error</dfn>
   run the <a href="#request-error">request error</a> steps for exception <a
   href="#abort-err"><code>ABORT_ERR</code></a>.

  <p>When something is said to be a <dfn id=request-error>request error</dfn>
   for exception <var>exception</var> run these steps:

  <ol>
   <li>
    <p>The user agent <em class=ct>should</em> cancel any network activity
     for which the object is responsible.

   <li>
    <p>If there are any <a href="#task" title=task>tasks</a> from the
     object's <a
     href="#xmlhttprequest-task-source"><code>XMLHttpRequest</code> task
     source</a> in one of the <a href="#task-queues">task queues</a>, then
     remove those tasks.

   <li>
    <p>Set the <a href="#response-entity-body">response entity body</a> to
     null.

   <li>
    <p>Empty the list of <a href="#author-request-headers">author request
     headers</a>.

   <li>
    <p>Set the the <a href="#error-flag">error flag</a> to true.

   <li>
    <p>Switch the state to <a href="#dom-xmlhttprequest-done"
     title=dom-XMLHttpRequest-DONE>DONE</a>.

   <li>
    <p>If the <a href="#asynchronous-flag">asynchronous flag</a> is false
     raise an <var>exception</var> exception and terminate the overall set of
     steps.

   <li>
    <p><a href="#dispatch-readystatechange-event">Dispatch a
     <code>readystatechange</code> event</a>.</p>

    <p class=note>At this point it is clear that the <a
     href="#asynchronous-flag">asynchronous flag</a> is true.</p>

   <li>
    <p>Terminate the overall algorithm.
  </ol>

  <p class=note>A future version of this specification will dispatch an <code
   title=event-xhr-error>error</code>/<code>abort</code> event here as well.
   (Depending on the type of error.)

  <hr>

  <p>When it is said to <dfn id=switch-headers-received>switch to the
   HEADERS_RECEIVED state</dfn> run these steps:

  <ol>
   <li>
    <p>Switch the state to <a href="#dom-xmlhttprequest-headers_received"
     title="dom-XMLHttpRequest-HEADERS_RECEIVED">HEADERS_RECEIVED</a>.

   <li>
    <p><a href="#dispatch-readystatechange-event">Dispatch a
     <code>readystatechange</code> event</a>.
  </ol>

  <p>When it is said to <dfn id=switch-loading>switch to the LOADING
   state</dfn> run these steps:

  <ol>
   <li>
    <p>Switch the state to <a href="#dom-xmlhttprequest-loading"
     title=dom-XMLHttpRequest-LOADING>LOADING</a>.

   <li>
    <p><a href="#dispatch-readystatechange-event">Dispatch a
     <code>readystatechange</code> event</a>.
  </ol>

  <p>When it is said to <dfn id=switch-done>switch to the DONE state</dfn>
   run these steps:

  <ol>
   <li>
    <p>If the <a href="#asynchronous-flag">asynchronous flag</a> is false
     update the <a href="#response-entity-body">response entity body</a>.

   <li>
    <p>Switch the state to <a href="#dom-xmlhttprequest-done"
     title=dom-XMLHttpRequest-DONE>DONE</a>.

   <li>
    <p><a href="#dispatch-readystatechange-event">Dispatch a
     <code>readystatechange</code> event</a>.
  </ol>

  <h4 id=the-abort-method><span class=secno>3.6.5. </span>The <code
   title="">abort()</code> method</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <a href="#dom-xmlhttprequest-abort"><code
    title=dom-XMLHttpRequest-abort>abort()</code></a>

   <dd>Cancels any network activity.
  </dl>

  <p>When the <dfn id=dom-xmlhttprequest-abort
   title=dom-XMLHttpRequest-abort><code>abort()</code></dfn> method is
   invoked, the user agent <em class=ct>must</em> run these steps (unless
   otherwise noted):

  <ol>
   <li>
    <p><a href="#abort-send-algorithm" title="abort send()">Abort the
     <code>send()</code> algorithm</a>.

   <li>
    <p>The user agent <em class=ct>should</em> cancel any network activity
     for which the object is responsible.

   <li>
    <p>If there are any <a href="#task" title=task>tasks</a> from the
     object's <a
     href="#xmlhttprequest-task-source"><code>XMLHttpRequest</code> task
     source</a> in one of the <a href="#task-queues">task queues</a>, then
     remove those tasks.

   <li>
    <p>Set the <a href="#response-entity-body">response entity body</a> to
     null.

   <li>
    <p>Empty the list of <a href="#author-request-headers">author request
     headers</a>.

   <li>
    <p>Set the <a href="#error-flag">error flag</a> to true.

   <li>
    <p>If the state is <a href="#dom-xmlhttprequest-unsent"
     title=dom-XMLHttpRequest-UNSENT>UNSENT</a>, <a
     href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a> with the <a
     href="#send-flag"><code>send()</code> flag</a> being false, or <a
     href="#dom-xmlhttprequest-done" title=dom-XMLHttpRequest-DONE>DONE</a>
     go to the next step.</p>

    <p>Otherwise run these substeps:</p>

    <ol>
     <li>
      <p>Switch the state to <a href="#dom-xmlhttprequest-done"
       title=dom-XMLHttpRequest-DONE>DONE</a>.

     <li>
      <p>Set the <a href="#send-flag"><code>send()</code> flag</a> to false.

     <li>
      <p><a href="#dispatch-readystatechange-event">Dispatch a
       <code>readystatechange</code> event</a>.
    </ol>

    <p class=note>A future version of this specification will dispatch an
     <code title=event-xhr-abort>abort</code> event here.</p>

   <li>
    <p>Switch the state to <a href="#dom-xmlhttprequest-unsent"
     title=dom-XMLHttpRequest-UNSENT>UNSENT</a>.</p>

    <p class=note>No <code
     title=event-xhr-readystatechange>readystatechange</code> event is
     dispatched.</p>
  </ol>

  <h3 id=response><span class=secno>3.7. </span>Response</h3>

  <h4 id=the-status-attribute><span class=secno>3.7.1. </span>The <code
   title="">status</code> attribute</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <a
    href="#dom-xmlhttprequest-status"><code
    title=dom-XMLHttpRequest-status>status</code></a>

   <dd>
    <p>Returns the HTTP status code.
  </dl>

  <p>The <dfn id=dom-xmlhttprequest-status
   title=dom-XMLHttpRequest-status><code>status</code></dfn> attribute <em
   class=ct>must</em> return the result of running these steps:

  <ol>
   <li>
    <p>If the state is <a href="#dom-xmlhttprequest-unsent"
     title=dom-XMLHttpRequest-UNSENT>UNSENT</a> or <a
     href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a> return 0 and terminate these
     steps.

   <li>
    <p>If the <a href="#error-flag">error flag</a> is true return 0 and
     terminate these steps.

   <li>
    <p>Return the HTTP status code.
  </ol>

  <h4 id=the-statustext-attribute><span class=secno>3.7.2. </span>The <code
   title="">statusText</code> attribute</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <a
    href="#dom-xmlhttprequest-statustext"><code
    title=dom-XMLHttpRequest-statusText>statusText</code></a>

   <dd>
    <p>Returns the HTTP status text.
  </dl>

  <p>The <dfn id=dom-xmlhttprequest-statustext
   title=dom-XMLHttpRequest-statusText><code>statusText</code></dfn>
   attribute <em class=ct>must</em> return the result of running these steps:

  <ol>
   <li>
    <p>If the state is <a href="#dom-xmlhttprequest-unsent"
     title=dom-XMLHttpRequest-UNSENT>UNSENT</a> or <a
     href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a> return the empty string and
     terminate these steps.

   <li>
    <p>If the <a href="#error-flag">error flag</a> is true return the empty
     string and terminate these steps.

   <li>
    <p>Return the HTTP status text.
  </ol>

  <h4 id=the-getresponseheader-method><span class=secno>3.7.3. </span>The
   <code title="">getResponseHeader()</code> method</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <a
    href="#dom-xmlhttprequest-getresponseheader"><code
    title=dom-XMLHttpRequest-getResponseHeader>getResponseHeader(<var
    title="">header</var>)</code></a>

   <dd>
    <p>Returns the header field value from the response of which the field
     name matches <var title="">header</var>, unless the field name is
     <code>Set-Cookie</code> or <code>Set-Cookie2</code>.
  </dl>

  <p>When the <dfn id=dom-xmlhttprequest-getresponseheader
   title=dom-XMLHttpRequest-getResponseHeader><code>getResponseHeader(<var
   title="">header</var>)</code></dfn> is invoked, the user agent <em
   class=ct>must</em> run these steps:

  <ol>
   <li>
    <p>If the state is <a href="#dom-xmlhttprequest-unsent"
     title=dom-XMLHttpRequest-UNSENT>UNSENT</a> or <a
     href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a> return null and terminate
     these steps.

   <li>
    <p>If the <a href="#error-flag">error flag</a> is true return null and
     terminate these steps.

   <li>
    <p>If any code point in <var>header</var> is higher than U+00FF LATIN
     SMALL LETTER Y WITH DIAERESIS return null and terminate these steps.

   <li>
    <p>Let <var>header</var> be the result of <span title="deflate a
     DOMString into an byte sequence">deflating</span> <var>header</var>.
   </li>
   <!-- This sounds lame, but it works. -->

   <li>
    <p>If <var>header</var> is a case-insensitive match for
     <code>Set-Cookie</code> or <code>Set-Cookie2</code> return null and
     terminate these steps.

   <li>
    <p>If <var>header</var> is a case-insensitive match for multiple HTTP
     response headers, return the <span title="inflate an byte sequence into
     a DOMString">inflated</span> values of these headers as a single
     concatenated string separated from each other by a U+002C COMMA U+0020
     SPACE character pair and terminate these steps.

   <li>
    <p>If <var>header</var> is a case-insensitive match for a single HTTP
     response header, return the <span title="inflate an byte sequence into a
     DOMString">inflated</span> value of that header and terminate these
     steps.

   <li>
    <p>Return null.
  </ol>

  <div class=example>
   <p>For the following script:</p>

   <pre><code>var client = new XMLHttpRequest();
client.open("GET", "unicorns-are-teh-awesome.txt", true);
client.send();
client.onreadystatechange = function() {
  if(this.readyState == 2) {
    print(client.getResponseHeader("Content-Type"));
  }
}</code></pre>

   <p>The <code>print()</code> function will get to process something like:</p>

   <pre><code>text/plain; charset=UTF-8</code></pre>
  </div>

  <h4 id=the-getallresponseheaders-method><span class=secno>3.7.4. </span>The
   <code title="">getAllResponseHeaders()</code> method</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <code
    title=dom-XMLHttpRequest-getAllResponseHeaders>getAllResponseHeaders()</code>

   <dd>
    <p>Returns all headers from the response, with the exception of those
     whose field name is <code>Set-Cookie</code> or <code>Set-Cookie2</code>.
  </dl>

  <p>When the <dfn
   id=dom-xmlhttprequest-getallresponseheaders><code>getAllResponseHeaders()</code></dfn>
   method is invoked, the user agent <em class=ct>must</em> run the following
   steps:

  <ol>
   <li>
    <p>If the state is <a href="#dom-xmlhttprequest-unsent"
     title=dom-XMLHttpRequest-UNSENT>UNSENT</a> or <a
     href="#dom-xmlhttprequest-opened"
     title=dom-XMLHttpRequest-OPENED>OPENED</a> return the empty string and
     terminate these steps.

   <li>
    <p>If the <a href="#error-flag">error flag</a> is true return the empty
     string and terminate these steps.

   <li>
    <p>Return all the HTTP headers, excluding headers that are a
     case-insensitive match for <code>Set-Cookie</code> or
     <code>Set-Cookie2</code>, <span title="inflate an byte sequence into a
     DOMString">inflated</span>, as a single string, with each header line
     separated by a U+000D CR U+000A LF pair, excluding the status line, and
     with each header name and header value separated by a U+003A COLON
     U+0020 SPACE pair.
  </ol>

  <div class=example>
   <p>For the following script:</p>

   <pre><code>var client = new XMLHttpRequest();
client.open("GET", "narwhals-too.txt", true);
client.send();
client.onreadystatechange = function() {
 if(this.readyState == 2) {
  print(this.getAllResponseHeaders());
 }
}</code></pre>

   <p>The <code>print()</code> function will get to process something like:</p>

   <pre><code>Date: Sun, 24 Oct 2004 04:58:38 GMT
Server: Apache/1.3.31 (Unix)
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/plain; charset=utf-8</code></pre>
  </div>

  <h4 id=response-entity-body0><span class=secno>3.7.5. </span>Response
   Entity Body</h4>

  <p>The <dfn id=response-mime-type>response MIME type</dfn> is the MIME type
   the <code>Content-Type</code> header contains without any parameters or
   null if the header could not be parsed properly or was omitted. The <dfn
   id=override-mime-type>override MIME type</dfn> is always null. <dfn
   id=final-mime-type>Final MIME type</dfn> is the override MIME type unless
   that is null in which case it is the response MIME type.

  <p>The <dfn id=response-charset>response charset</dfn> is the value of the
   <code>charset</code> parameter of the <code>Content-Type</code> header or
   null if there was no <code>charset</code> parameter or if the header could
   not be parsed properly or was omitted. The <dfn
   id=override-charset>override charset</dfn> is always null. <dfn
   id=final-charset>Final charset</dfn> is the override charset unless that
   is null in which case it is the response charset.

  <p class=note><a href="#override-mime-type">Override MIME type</a> and <a
   href="#override-charset">override charset</a> are introduced here solely
   to make editing several levels of XMLHttpRequest simultaneously somewhat
   easier. Apologies for any confusion they might cause.

  <hr>

  <p>The <dfn id=response-entity-body>response entity body</dfn> is the
   fragment of the <a href="#entity-body">entity body</a> of the response
   received so far (<a href="#dom-xmlhttprequest-loading"
   title=dom-XMLHttpRequest-LOADING>LOADING</a>) or the complete entity body
   of the response (<a href="#dom-xmlhttprequest-done"
   title=dom-XMLHttpRequest-DONE>DONE</a>). If the response does not have an
   entity body the response entity body is null.

  <p class=note>The <a href="#response-entity-body">response entity body</a>
   is updated as part of the <a href="#dom-xmlhttprequest-send"><code
   title=dom-XMLHttpRequest-send>send()</code></a> algorithm.

  <hr>

  <p>The <dfn id=text-response-entity-body>text response entity body</dfn> is
   a <code>DOMString</code> representing the <a
   href="#response-entity-body">response entity body</a>. The text response
   entity body is the return value of the following algorithm:

  <ol>
   <li>
    <p>If the response entity body is null return the empty string and
     terminate these steps.</p>

   <li>
    <p>Let <var>charset</var> be the <a href="#final-charset">final
     charset</a>.

   <li>
    <p>Let <var>mime</var> be the <a href="#final-mime-type">final MIME
     type</a>.

   <li>
    <p>If <var>charset</var> is null and <var>mime</var> is null,
     <code>text/xml</code>, <code>application/xml</code> or ends in <code
     title="">+xml</code> use the rules set forth in the XML specifications
     to determine the character encoding. Let <var>charset</var> be the
     determined character encoding.

   <li>
    <p>If <var>charset</var> is null and <var>mime</var> is
     <code>text/html</code> follow the rules set forth in the HTML
     specification to determine the character encoding. Let
     <var>charset</var> be the determined character encoding. [<cite><a
     href="#ref-html5">HTML5</a></cite>]

   <li>
    <p>If <var>charset</var> is null then, for each of the rows in the
     following table, starting with the first one and going down, if the
     first bytes of <var>bytes</var> match the bytes given in the first
     column, then let <var>charset</var> be the encoding given in the cell in
     the second column of that row. If there is no match <var>charset</var>
     remains null.</p>

    <table>
     <thead>
      <tr>
       <th>Bytes in Hexadecimal

       <th>Description

     <tbody>
      <tr>
       <td>FE FF

       <td>UTF-16BE BOM

      <tr>
       <td>FF FE

       <td>UTF-16LE BOM

      <tr>
       <td>EF BB BF

       <td>UTF-8 BOM
    </table>

   <li>
    <p>If <var>charset</var> is null let <var>charset</var> be UTF-8.

   <li>
    <p>Return the result of decoding the response entity body using
     <var>charset</var>. Replace bytes or sequences of bytes that are not
     valid accordng to the <var>charset</var> with a single U+FFFD
     REPLACEMENT CHARACTER character.
  </ol>

  <p class=note>Authors are strongly encouraged to encode their resources
   using UTF-8.

  <hr>

  <p>The <dfn id=document-response-entity-body>document response entity
   body</dfn> is either a <code>Document</code> representing the <a
   href="#response-entity-body">response entity body</a> or null. The
   document response entity body is the return value of the following
   algorithm:

  <ol>
   <li>
    <p>If the <a href="#response-entity-body">response entity body</a> is
     null terminate these steps and return null.

   <li>
    <p>If <a href="#final-mime-type">final MIME type</a> is not null,
     <code>text/xml</code>, <code>application/xml</code>, and does not end in
     <code title="">+xml</code> terminate these steps and return null.

   <li>
    <p>Let <var>document</var> be a <a
     href="#cookie-free-document-object">cookie-free <code>Document</code>
     object</a> that represents the result of parsing the response entity
     body into a document tree following the rules from the XML
     specifications. If this fails (unsupported character encoding, namespace
     well-formedness error et cetera) terminate these steps return null.
     [<cite><a href="#ref-xml">XML</a></cite>]</p>

    <p class=note>Scripts in the resulting document tree will not be
     executed, resources referenced will not be loaded and no associated XSLT
     will be applied.</p>

   <li>
    <p>Return <var>document</var>.
  </ol>

  <h4 id=the-responsetext-attribute><span class=secno>3.7.6. </span>The <code
   title="">responseText</code> attribute</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <a
    href="#dom-xmlhttprequest-responsetext"><code
    title=dom-XMLHttpRequest-responseText>responseText</code></a>

   <dd>
    <p>Returns the <a href="#text-response-entity-body">text response entity
     body</a>.
  </dl>

  <p>The <dfn id=dom-xmlhttprequest-responsetext
   title=dom-XMLHttpRequest-responseText><code>responseText</code></dfn>
   attribute <em class=ct>must</em> return the result of running these steps:

  <ol>
   <li>
    <p>If the state is not <a href="#dom-xmlhttprequest-loading"
     title=dom-XMLHttpRequest-LOADING>LOADING</a> or <a
     href="#dom-xmlhttprequest-done" title=dom-XMLHttpRequest-DONE>DONE</a>
     return the empty string and terminate these steps.

   <li>
    <p>Return the <a href="#text-response-entity-body">text response entity
     body</a>.
  </ol>

  <h4 id=the-responsexml-attribute><span class=secno>3.7.7. </span>The <code
   title="">responseXML</code> attribute</h4>

  <dl class=domintro>
   <dt><var title="">client</var> . <a
    href="#dom-xmlhttprequest-responsexml"><code
    title=dom-XMLHttpRequest-responseXML>responseXML</code></a>

   <dd>
    <p>Returns the <a href="#document-response-entity-body">document response
     entity body</a>.
  </dl>

  <p>The <dfn id=dom-xmlhttprequest-responsexml
   title=dom-XMLHttpRequest-responseXML><code>responseXML</code></dfn>
   attribute <em class=ct>must</em> return the result of running these steps:

  <ol>
   <li>
    <p>If the state is not <a href="#dom-xmlhttprequest-done"
     title=dom-XMLHttpRequest-DONE>DONE</a> return null and terminate these
     steps.

   <li>
    <p>Return the <a href="#document-response-entity-body">document response
     entity body</a>.
   </li>
   <!-- XXX same object -->
  </ol>

  <h2 id=exceptions><span class=secno>4. </span>Exceptions</h2>

  <p>Several algorithms in this specification may result in an exception
   being thrown. These exceptions are all part of the group
   <code>ExceptionCode</code> and use the <code>DOMException</code> object,
   which is defined in DOM Level 3 Core. In addition this specification
   extends the <code>ExceptionCode</code> group with several new constants as
   indicated below. [<cite><a href="#ref-dom3core">DOM3Core</a></cite>]

  <p class=note>Thus, exceptions used by this specification and not defined
   in this section are defined by DOM Level 3 Core.

  <pre
   class=idl>const unsigned short <a href="#security-err">SECURITY_ERR</a> = 18;
const unsigned short <a href="#network-err">NETWORK_ERR</a> = 19;
const unsigned short <a href="#abort-err">ABORT_ERR</a> = 20;</pre>

  <p>The <dfn id=security-err><code>SECURITY_ERR</code></dfn> exception is
   raised if an attempt is made to perform an operation or access some data
   in a way that would be a security risk or a violation of the user agent's
   security policy.</p>
  <!-- http://lists.w3.org/Archives/Public/public-webapi/2006May/0027.html -->

  <p>The <dfn id=network-err><code>NETWORK_ERR</code></dfn> exception is
   raised when a network error occurs in synchronous requests.

  <p>The <dfn id=abort-err><code>ABORT_ERR</code></dfn> exception is raised
   when the user aborts a request in synchronous requests.

  <p class=note>These exceptions will be folded into an update of DOM Level 3
   Core in due course, as they are appropriate for other API specifications
   as well.

  <h2 class=no-num id=references>References</h2>

  <p>Unless marked "Non-normative" these references are normative.

  <dl>
   <dt>[<dfn id=ref-cookies>COOKIES</dfn>]

   <dd><cite><a
    href="http://tools.ietf.org/html/draft-ietf-httpstate-cookie">HTTP State
    Management Mechanism</a></cite> (work in progress), A. Barth. IETF.

   <dt>[<dfn id=ref-dom2events>DOM2Events</dfn>]

   <dd><cite><a href="http://www.w3.org/TR/DOM-Level-2-Events/">Document
    Object Model (DOM) Level 2 Events Specification</a></cite>, T. Pixley.
    W3C.

   <dt>[<dfn id=ref-dom3core>DOM3Core</dfn>]

   <dd><cite><a href="http://www.w3.org/TR/DOM-Level-3-Core">Document Object
    Model (DOM) Level 3 Core Specification</a></cite>, A. Le Hors, P. Le
    H&eacute;garet, L. Wood, G. Nicol, J. Robie, M. Champion, S. Byrne. W3C.

   <dt>[<dfn id=ref-ecmascript>ECMAScript</dfn>]

   <dd><cite><a
    href="http://www.ecma-international.org/publications/standards/Ecma-262.htm">ECMAScript
    Language Specification</a></cite>. ECMA.

   <dt>[<dfn id=ref-html5>HTML5</dfn>]

   <dd><cite><a href="http://www.w3.org/html/wg/html5/">HTML5</a></cite>
    (work in progress), I. Hickson. W3C.

   <dd><cite><a
    href="http://www.whatwg.org/specs/web-apps/current-work/">HTML5</a></cite>
    (work in progress), I. Hickson. WHATWG.

   <dt>[<dfn id=ref-httpverbsec>HTTPVERBSEC</dfn>]

   <dd>(Non-normative) <cite><a
    href="http://www.kb.cert.org/vuls/id/867593">Multiple vendors' web
    servers enable HTTP TRACE method by default</a></cite>, US-CERT.

   <dd>(Non-normative) <cite><a
    href="http://www.kb.cert.org/vuls/id/288308">Microsoft Internet
    Information Server (IIS) vulnerable to cross-site scripting via HTTP
    TRACK method</a></cite>, US-CERT.

   <dd>(Non-normative) <cite><a
    href="http://www.kb.cert.org/vuls/id/150227">HTTP proxy default
    configurations allow arbitrary TCP connections</a></cite>, US-CERT.

   <dt>[<dfn id=ref-rfc2046>RFC2046</dfn>]

   <dd><cite><a href="http://ietf.org/rfc/rfc2046">Multipurpose Internet Mail
    Extensions (MIME) Part Two: Media Types</a></cite>, N. Freed, N.
    Borenstein. IETF.

   <dt>[<dfn id=ref-rfc2119>RFC2119</dfn>]

   <dd><cite><a href="http://ietf.org/rfc/rfc2119">Key words for use in RFCs
    to Indicate Requirement Levels</a></cite>, S. Bradner. IETF.

   <dt>[<dfn id=rfc-rfc2616>RFC2616</dfn>]

   <dd><cite><a href="http://ietf.org/rfc/rfc2616">Hypertext Transfer
    Protocol -- HTTP/1.1</a></cite>, R. Fielding, J. Gettys, J. Mogul, H.
    Frystyk, L. Masinter, P. Leach, T. Berners-Lee. IETF.

   <dt>[<dfn id=ref-rfc2617>RFC2617</dfn>]

   <dd><cite><a href="http://ietf.org/rfc/rfc2617">HTTP Authentication: Basic
    and Digest Access Authentication</a></cite>, P. Hallam-Baker, J.
    Hostetler, S. Lawrence, P. Leach, A. Luotonen, L. Stewart. IETF.

   <dt>[<dfn id=ref-rfc3986>RFC3986</dfn>]

   <dd><cite><a href="http://ietf.org/rfc/rfc3986">Uniform Resource
    Identifier (URI): Generic Syntax</a></cite>, T. Berners-Lee, R. Fielding,
    L. Masinter. IETF.

   <dt>[<dfn id=ref-rfc3987>RFC3987</dfn>]

   <dd><cite><a href="http://ietf.org/rfc/rfc3987">Internationalized Resource
    Identifiers (IRIs)</a></cite>, M. Duerst, M. Suignard. IETF.

   <dt>[<dfn id=ref-webidl>WebIDL</dfn>]

   <dd><cite><a href="http://dev.w3.org/2006/webapi/WebIDL/">Web
    IDL</a></cite> (work in progress), C. McCormack. W3C.</dd>
   <!-- XXX add Sam -->

   <dt>[<dfn id=ref-xml>XML</dfn>]

   <dd><cite><a href="http://www.w3.org/TR/xml/">Extensible Markup Language
    (XML) 1.0</a></cite>, T. Bray, J. Paoli, C. Sperberg-McQueen, E. Maler,
    F. Yergeau. W3C.

   <dd><cite><a href="http://www.w3.org/TR/xml-names/">Namespaces in
    XML</a></cite>, T. Bray, D. Hollander, A. Layman, R. Tobin, H. S.
    Thompson. W3C.
  </dl>

  <h2 class=no-num id=acknowledgments>Acknowledgments</h2>

  <p>The editor would like to thank Addison Phillips, Ahmed Kamel, Alex
   Hopmann, Alex Vincent, Alexey Proskuryakov, Asbj&oslash;rn Ulsberg, Boris
   Zbarsky, Bj&ouml;rn H&ouml;hrmann, Cameron McCormack, Christophe Jolif,
   Charles McCathieNevile, Dan Winship, David Andersson, David
   H&aring;s&auml;ther, David Levin, Dean Jackson, Denis Sureau, Doug
   Schepers, Douglas Livingstone, Elliotte Harold, Eric Lawrence, Erik
   Dahlstr&ouml;m, Geoffrey Sneddon, Gideon Cohn, Gorm Haug Eriksen,
   H&aring;kon Wium Lie, Hallvord R. M. Steen, Huub Schaeks, Ian Davis, Ian
   Hickson, Ivan Herman, Jeff Walden, Jens Lindstr&ouml;m, Jim Deegan, Jim
   Ley, Joe Farro, Jonas Sicking, Julian Reschke, Karl Dubost, Lachlan Hunt,
   Maciej Stachowiak, Magnus Kristiansen, Marc Hadley, Marcos Caceres, Mark
   Baker, Mark Birbeck, Mark Nottingham, Mark S. Miller, Martin Hassman,
   Mohamed Zergaoui, Olli Pettay, Pawel Glowacki, Peter Michaux, Philip
   Taylor, Robin Berjon, Rune Halvorsen, Ruud Steltenpool, Simon Pieters,
   Stewart Brodie, Sunava Dutta, Thomas Roessler, Tom Magliery, and Zhenbin
   Xu for their contributions to this specification.

  <p>Special thanks to the Microsoft employees who first implemented the
   <code title="">XMLHttpRequest</code> interface, which was first widely
   deployed by the Windows Internet Explorer browser.

  <p>Special thanks also to the WHATWG for drafting an initial version of
   this specification in their Web Applications 1.0 document (now renamed to
   HTML5). [<cite><a href="#ref-html5">HTML5</a></cite>]

  <p>Thanks also to all those who have helped to improve this specification
   by sending suggestions and corrections. (Please, keep bugging us with your
   issues!)