HTTP/2 200
x-guploader-uploadid: ABgVH8-HizruKMdivAUkGK_j0_iJMO1Ro2Qr6Rj5ZkF_KT3CDJ2SHDSJgkTEtq5l5XkV6uju
x-goog-generation: 1752626794789990
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 60799
x-goog-meta-goog-reserved-file-mtime: 1752625556
x-goog-hash: crc32c=ys6Mvw==, md5=e64aGxQ58bKSEEkRGt9dEA==
x-goog-storage-class: STANDARD
accept-ranges: none
expires: Fri, 18 Jul 2025 07:47:18 GMT
cache-control: public, max-age=3600
last-modified: Wed, 16 Jul 2025 00:46:34 GMT
etag: W/"7bae1a1b1439f1b2921049111adf5d10"
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
alt-svc: clear
x-content-type-options: nosniff
strict-transport-security: max-age=63072000
content-security-policy: default-src 'self'; script-src 'report-sample' 'self' 'wasm-unsafe-eval' https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/js assets.codepen.io production-assets.codepen.io https://js.stripe.com 'sha256-EehWlTYp7Bqy57gDeQttaWKp0ukTTEUKGP44h8GVeik=' 'sha256-XNBp89FG76amD8BqrJzyflxOF9PaWPqPqvJfKZPCv7M='; script-src-elem 'report-sample' 'self' 'wasm-unsafe-eval' https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/js assets.codepen.io production-assets.codepen.io https://js.stripe.com 'sha256-EehWlTYp7Bqy57gDeQttaWKp0ukTTEUKGP44h8GVeik=' 'sha256-XNBp89FG76amD8BqrJzyflxOF9PaWPqPqvJfKZPCv7M='; style-src 'report-sample' 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; connect-src 'self' developer.allizom.org bcd.developer.allizom.org bcd.developer.mozilla.org updates.developer.allizom.org updates.developer.mozilla.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://incoming.telemetry.mozilla.org https://observatory-api.mdn.allizom.net https://observatory-api.mdn.mozilla.net https://api.github.com/search/issues stats.g.doubleclick.net https://api.stripe.com; font-src 'self'; frame-src 'self' interactive-examples.mdn.mozilla.net interactive-examples.mdn.allizom.net mdn.github.io live-samples.mdn.mozilla.net live-samples.mdn.allizom.net *.mdnplay.dev *.mdnyalp.dev *.play.test.mdn.allizom.net https://v2.scrimba.com https://scrimba.com jsfiddle.net www.youtube-nocookie.com codepen.io survey.alchemer.com https://js.stripe.com; img-src 'self' data: *.githubusercontent.com *.googleusercontent.com *.gravatar.com mozillausercontent.com firefoxusercontent.com profile.stage.mozaws.net profile.accounts.firefox.com developer.mozilla.org mdn.dev interactive-examples.mdn.mozilla.net interactive-examples.mdn.allizom.net wikipedia.org upload.wikimedia.org https://mdn.github.io/shared-assets/ https://mdn.dev/ https://*.google-analytics.com https://*.googletagmanager.com www.gstatic.com; manifest-src 'self'; media-src 'self' archive.org videos.cdn.mozilla.net https://mdn.github.io/shared-assets/; child-src 'self'; worker-src 'self';
x-frame-options: DENY
origin-trial: AxVILwizhbMjxFeHOn1P3R8niO1RJY/smaK4B4d1rLzc1gTaxtXMSaTi+FoigYgCw40uFRDwFcEAeqDR+vVLOW4AAABfeyJvcmlnaW4iOiJodHRwczovL2RldmVsb3Blci5tb3ppbGxhLm9yZyIsImZlYXR1cmUiOiJQcml2YXRlQXR0cmlidXRpb25WMiIsImV4cGlyeSI6MTc0MjA3OTYwMH0=
x-cloud-trace-context: 8fe2fe7b77b0d041eb695a539764b14f;o=1
date: Fri, 18 Jul 2025 06:47:18 GMT
server: Google Frontend
via: 1.1 google
vary: Accept-Encoding
content-encoding: gzip
x-cache: miss
XMLHttpRequest: XMLHttpRequest() constructor - Web APIs | MDN
XMLHttpRequest: XMLHttpRequest() constructor Baseline Widely available
The XMLHttpRequest()
constructor
creates a new XMLHttpRequest
.
new XMLHttpRequest()
// Non-standard
new XMLHttpRequest(options)
There are no standard parameters. However, Firefox allows a non-standard parameter:
options
Non-standard
An object that can contain the following flags:
mozAnon
A boolean. When setting this flag to true
will cause the browser not to expose the origin and user credentials when fetching resources. Most important, this means that cookies will not be sent unless explicitly added using setRequestHeader
.
mozSystem
A boolean. When setting this flag to true
, the same origin policy will not be enforced on the request.
A new XMLHttpRequest
object. The object must be prepared by at least
calling open()
to initialize it before calling
send()
to send the request to the server.