also detect 'fetch()' requests as ajax

apache · Jan 3, 2025 · 44106de · 44106de
1 parent 06b7b89
commit 44106de
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/Allura/allura/lib/utils.py b/Allura/allura/lib/utils.py
@@ -709,6 +709,12 @@ def unique_attachments(attachments):
 def is_ajax(request):
     if request.headers.get('X-Requested-With', None) == 'XMLHttpRequest':
         return True
+    # fetch - see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode
+    if (
+        request.headers.get('Sec-Fetch-Mode', None) in ('cors', 'no-cors', 'same-origin')
+        and request.headers.get('Sec-Fetch-Dest', None) == 'empty'
+    ):
+        return True
     return False