ajax可以伪造的头部信息

ajax可以伪造部分header头信息, 但有部分http header并不能被模拟, 会被忽略或在浏览器发送请求时覆盖掉.

如下文, 另外 refer是会被浏览器覆盖掉的.

http://www.w3school.com.cn/xmldom/dom_xmlserializer.asp#footer

有些请求头部由 XMLHttpRequest 自动设置而不是由这个方法设置，以符合 HTTP 协议。这包括如下和代理相关的头部：

• Host
• Connection
• Keep-Alive
• Accept-charset
• Accept-Encoding
• If-Modified-Since
• If-None-Match
• If-Range
• Range

http://www.w3.org/TR/2006/WD-XMLHttpRequest-20060405/#dfn-setrequestheader

User agents must not set any headers other than the headers set by the author using this method, with the following exceptions:

• UAs must set the Host header appropriately (see open()) and not allow it to be overridden.
• UAs must set the Authorization header according to the values passed to the open() method (but must allow calls to setRequestHeader() to append values to it).
• UAs may set the Accept-Charset and Accept-Encoding headers and must not allow them to be overridden.
• UAs may set the If-Modified-Since, If-None-Match, If-Range, and Range headers if the resource is cached and has not expired (as allowed by HTTP), and must notallow those headers to be overridden.
• UAs must set the Connection and Keep-Alive headers as described by the HTTP specification, and must not allow those headers to be overridden.
• UAs should set the proxy-related headers according to proxy settings of the environment, and must not allow those headers to be overridden.
• UAs may give the User-Agent header an initial value, but must allow authors to append values to it.
• UAs should set Cookie and Cookie2 headers appropriately for the given URI and given the user's current cookies, and must allow authors to append values to these headers.