Question

Page A contains javascripts function executing XMLHttpRequest. Page A loads page B in iframe. Page B executes parent.makeRequest() function which in turn executes the XHR request. I expect the referrer/origin of the XHR request to be page B, however it is page A. Is there any way to fix this?

Answer 1

You cannot control the value of the Referer header.

Some HTTP headers can be adjusted when making XHR requests using the setRequestHeader method. However, the Referer header is specifically excepted. From the specifications:

The above headers [including Referer] are controlled by the user agent to let it control those aspects of transport. This guarantees data integrity to some extent.

You could, however, set a custom header. For instance, you could use X-Referer, if this suits your application:

xhr.setRequestHeader('X-Referer', location.href);