Re: Extension methods & XMLHttpRequest

Jamie Lokier wrote:
> Therefore to prevent subversion of HTTP message boundaries,
> XMLHttpRequest should prevent:
> 
>     - The CONNECT method
>     - Setting the Upgrade header
> 
> I don't see any reason to disallow any other request methods.

Come to think of it, what about TRACE?

Google for TRACE and XMLHTTP.  The top results reveal some cross-site
scripting vulnerabilities whereby a script can deduce cookie values
that it shouldn't by using TRACE with Microsoft's equivalent to
XMLHttpRequest.

However Googling for TRACE and XMLHttpRequest, the top results reveal
that TRACE is usefully used.

-- Jamie