[whatwg/xhr] Reset request body when open() is called (PR #404)

Otherwise the request body can leak into subsequent requests on the same XHR object.

- [x] At least two implementers are interested (and none opposed):
   * Chrome/Webkit/Gecko already implemented
- [x] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at:
   * This was found through the following WPT test
- [x] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed:
   * Chromium: N/A
   * Gecko: N/A
   * WebKit: N/A
- [x] [MDN issue](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) is filed: N/A
- [x] The top of this comment includes a [clear commit message](https://github.com/whatwg/meta/blob/main/COMMITTING.md) to use. <!-- If you created this PR from a single commit, Github copied its message. Otherwise, you need to add a commit message yourself. -->

(See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.)

You can view, comment on, or merge this pull request online at:

  https://github.com/whatwg/xhr/pull/404

-- Commit Summary --

  * Reset request body when open() is called

-- File Changes --

    M xhr.bs (1)

-- Patch Links --

https://github.com/whatwg/xhr/pull/404.patch
https://github.com/whatwg/xhr/pull/404.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/xhr/pull/404
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/xhr/pull/404@github.com>

Received on Saturday, 7 March 2026 17:35:09 UTC