XRequestedWith

X-Requested-With is an HTTP header historically used to identify requests that originate from JavaScript code making AJAX calls, rather than from standard page navigation. The most common value is XMLHttpRequest, and the header is often set automatically by older JavaScript libraries such as jQuery. It is a non-standard header, widely used in legacy code to flag requests as AJAX.

The primary purpose of the header is to let servers tailor responses or behavior for AJAX requests. A server might return a JSON payload instead of a full HTML page, skip rendering of layout components, or apply different caching rules when it detects X-Requested-With: XMLHttpRequest. Because it serves as a hint about how the request was initiated, it can influence content negotiation and performance optimizations in some environments. In modern front-end development, however, the header is not universally present, and its presence should not be relied upon for critical logic.

Security and reliability considerations are important. Because the header can be spoofed by a client, it should not be used for authentication, access control, or CSRF protection. Rely on proper CSRF tokens, same-origin policies, and robust authentication mechanisms rather than this header alone. If a cross-origin request uses a custom header such as X-Requested-With, it will trigger a CORS preflight request, adding overhead and visibility to the request.

In contemporary development, many tools and fetch-based approaches do not send X-Requested-With by default, reflecting the header’s status as a legacy convention. When it is used, developers should treat it as a useful signal for backward-compatible AJAX handling, rather than a security measure.