XMLHttpRequest Standard

cid 74fbda58e36d46d72301d35010ed305d732d385354f3add820fbb6600f7a3f60 · original · open access · via whatwg

Title: XMLHttpRequest Standard
Authors: 
Venue: whatwg
Year: 2026
Canonical: whatwg:xhr
URL: https://xhr.spec.whatwg.org/
Collector: whatwg
OA: true

ABSTRACT
XMLHttpRequest Standard XMLHttpRequest Living Standard — Last Updated 28 October 2026 Participate: GitHub whatwg/xhr (new issue, open issues) Chat on Matrix Commits: GitHub whatwg/xhr/commits Snapshot as of this commit Tests: web-platform-tests xhr/ (ongoing work) Translations (non-normative): 日本語 简体中文 한국어 Abstract The XMLHttpRequest Standard defines an API that provides scripted client functionality for transferring data between a client and a server. 1. Introduction This section is non-normative. The XMLHttpRequest object is an API for fetching resources. The name XMLHttpRequest is historical and has no bearing on its functionality. Some simple code to do something with data from an XML document fetched over the network: function processData(data) { // taking care of data } function handler() { if(this.status == 200 && this.responseXML != null && this.responseXML.getElementById('test').textContent) { // success! processData(this.responseXML.getElementById('test').textContent); } else { // something went wrong … } } var client = new XMLHttpRequest(); client.onload = handler; client.open("GET", "unicorn.xml"); client.send(); If you just want to log a message to the server: function log(message) { var client = new XMLHttpRequest(); client.open("POST", "/log"); client.setRequestHeader("Content-Type", "text/plain;charset=UTF-8"); client.send(message); } Or if you want to check the status of a document on the server: function fetchStatus(address) { var client = new XMLHttpRequest(); client.onload = function() { // in case of network errors this might not give reliable results returnStatus(this.status); } client.open("HEAD", address); client.send(); } 1.1. Specification history The XMLHttpRequest object was initially defined as part of the WHATWG’s HTML effort. (Based on Microsoft’s implementation many years prior.) It moved to the W3C in 2006. Extensions (e.g., progress events and cross-origin requests) to XMLHttpRequest were developed in a separate draft (XMLHttpRequest Level 2) until end of 2011, at which point the two drafts were merged and XMLHttpRequest became a single entity again from a standards perspective. End of 2012 it moved back to the WHATWG. Discussion that led to the current draft can be found in the following mailing list archives: whatwg@whatwg.org public-webapps@w3.org public-webapi@w3.org public-appformats@w3.org 2. Terminology This specification depends on the Infra Standard. [INFRA] This specification uses terminology from DOM, DOM Parsing and Serialization, Encoding, Fetch, File API, HTML, URL, Web IDL, and XML. [DOM] [DOM-PARSING] [ENCODING] [FETCH] [FILEAPI] [HTML] [URL] [WEBIDL] [XML] [XML-NAMES] 3. Interface XMLHttpRequest [Exposed=(Window,DedicatedWorker,SharedWorker)] interface XMLHttpRequestEventTarget : EventTarget { // event handlers attribute EventHandler onloadstart; attribute EventHandler onprogress; attribute EventHandler onabort; attribute EventHandler onerror; attribute EventHandler onload; attribute EventHandler ontimeout; attribute EventHandler onloadend; }; [Exposed=(Window,DedicatedWorker,SharedWorker)] interface XMLHttpRequestUpload : XMLHttpRequestEventTarget { }; enum XMLHttpRequestResponseType { "", "arraybuffer", "blob", "document", "json", "text" }; [Exposed=(Window,DedicatedWorker,SharedWorker)] interface XMLHttpRequest : XMLHttpRequestEventTarget { constructor(); // event handler attribute EventHandler onreadystatechange; // states const unsigned short UNSENT = 0; const unsigned short OPENED = 1; const unsigned short HEADERS_RECEIVED = 2; const unsigned short LOADING = 3; const unsigned short DONE = 4; readonly attribute unsigned short readyState; // request undefined open(ByteString method, USVString url); undefined open(ByteString method, USVString url, boolean async, optional USVString? username = null, optional USVString? password = null); undefined setRequestHeader(ByteString name, ByteString value); attribute unsigned long timeout; attribute boolean withCredentials; [SameObject] readonly attribute XMLHttpRequestUpload upload; undefined send(optional (Document or XMLHttpRequestBodyInit)? body = null); undefined abort(); // response readonly attribute USVString responseURL; readonly attribute unsigned short status; readonly attribute ByteString statusText; ByteString? getResponseHeader(ByteString name); ByteString getAllResponseHeaders(); undefined overrideMimeType(DOMString mime); attribute XMLHttpRequestResponseType responseType; readonly attribute any response; readonly attribute USVString responseText; [Exposed=Window] readonly attribute Document? responseXML; }; An XMLHttpRequest object has an associated: upload object An XMLHttpRequestUpload object. state One of unsent, opened, headers received, loading, and done; initially unsent. send() invoked A boolean, initially false. timeout An unsigned integer, initially 0. cross-origin credentials A boolean, initially false. request method A method. request URL A URL. author request headers A header list, initially empty. request body Initially null. synchronous A boolean, initially false. upload complete A boolean, initially false. upload listener A boolean, initially false. timed out A boolean, initially false. response A response, initially a network error. received bytes A byte sequence, initially the empty byte sequence. response type One of the empty string, "arraybuffer", "blob", "document", "json", and "text"; initially the empty string. response object An object, failure, or null, initially null. fetch controller A fetch controller, initially a new fetch controller. The send() method sets it to a useful fetch controller, but for simplicity it always holds a fetch controller. override MIME type A MIME type or null, initially null. Can get a value when overrideMimeType() is invoked. 3.1. Constructors client = new XMLHttpRequest() Returns a new XMLHttpRequest object. The new XMLHttpRequest() constructor steps are: Set this’s upload object to a new XMLHttpRequestUpload object. 3.2. Garbage collection An XMLHttpRequest object must not be garbage collected if its state is either opened with send() invoked being true, headers received, or loading, and it has one or more event listeners registered whose type is one of readystatechange, progress, abort, error, load, timeout, and loadend. If an XMLHttpRequest object is garbage collected while its connection is still open, the user agent must terminate the XMLHttpRequest object’s fetch controller. 3.3. Event handlers The following are the event handlers (and their corresponding event handler event types) that must be supported on objects implementing an interface that inherits from XMLHttpRequestEventTarget as attributes: event handler event handler event type onloadstart loadstart onprogress progress onabort abort onerror error onload load ontimeout timeout onloadend loadend The following is the event handler (and its corresponding event handler event type) that must be supported as attribute solely by the XMLHttpRequest object: event handler event handler event type onreadystatechange readystatechange 3.4. States client . readyState Returns client’s state. The readyState getter steps are to return the value from the table below in the cell of the second column, from the row where the value in the cell in the first column is this’s state: unsent UNSENT (numeric value 0) The object has been constructed. opened OPENED (numeric value 1) The open() method has been successfully invoked. During this state request headers can be set using setRequestHeader() and the fetch can be initiated using the send() method. headers received HEADERS_RECEIVED (numeric value 2) All redirects (if any) have been followed and all headers of a response have been received. loading LOADING (numeric value 3) The response body is being received. done DONE (numeric value 4) The data transfer has been completed or something went wrong during the transfer (e.g., infinite redirects). 3.5. Request Registering one or more event listeners on an XMLHttpRequestUpload object will result in a CORS-preflight request. (That is because registering an event listener causes upload listener to be set to true, which in turn causes the use-CORS-preflight flag to be set.) 3.5.1. The open() method client . open(method, url [, async = true [, username = null [, password = null]]]) Sets the request method, request URL, and whether the request is synchronous. Throws a "SyntaxError" DOMException if either method is not a valid method or url cannot be parsed. Throws a "SecurityError" DOMException if method is a case-insensitive match for `CONNECT`, `TRACE`, or `TRACK`. Throws an "InvalidAccessError" DOMException if async is false, the current global object is a Window object, and the timeout attribute is not zero or the responseType attribute is not the empty string. Synchronous XMLHttpRequest outside of workers is in the process of being removed from the web platform as it has detrimental effects to the end user’s experience. (This is a long process that takes many years.) Developers must not pass false for the async argument when the current global object is a Window object. User agents are strongly encouraged to warn about such usage in developer tools and may experiment with throwing an "InvalidAccessError" DOMException when it occurs. The open(method, url) and open(method, url, async, username, password) method steps are: If this’s relevant global object is a Window object and its associated Document is not fully active, then throw an "InvalidStateError" DOMException. If method is not a method, then throw a "SyntaxError" DOMException. If method is a forbidden method, then throw a "SecurityError" DOMException. Normalize method. Let parsedURL be the result of encoding-parsing a URL url, relative to this’s relevant settings object. If parsedURL is failure, then throw a "SyntaxError" DOMException. If the async argument is omitted, set async to true, and set username and password to null. Unfortunately legacy content prevents treating the async argument being undefined identical from it being omitted. If parsedURL’s host is non-null: If the username argument is not null, set the username given parsedURL and username. If the password argument is not null, set the password given parsedURL and password. If async is false, the current global object is a Window object, and either this’s timeout is not 0 or this’s response type is not the empty string, then throw an "InvalidAccessError" DOMException. Terminate this’s fetch controller. A fetch can be ongoing at this point. Set variables associated with the object as follows: Set this’s send() invoked to false. Set this’s request method to method. Set this’s request URL to parsedURL. Empty this’s author request headers. Set this’s request body to null. Set this’s synchronous to the inverse of async. Set this’s upload listener to false. Set this’s response to a network error. Set this’s received bytes to the empty byte sequence. Set this’s response object to null. Override MIME type is not overridden here as the overrideMimeType() method can be invoked before the open() method. If this’s state is not opened: Set this’s state to opened. Fire an event named readystatechange at this. The reason there are two open() methods defined is due to a limitation of the editing software used to write the XMLHttpRequest Standard. 3.5.2. The setRequestHeader() method client . setRequestHeader(name, value) Appends a value to an existing request header or adds a new request header. Throws an "InvalidStateError" DOMException if either state is not opened or send() invoked is true. Throws a "SyntaxError" DOMException if name is not a header name or if value is not a header value. The setRequestHeader(name, value) method steps are: If this’s state is not opened, then throw an "InvalidStateError" DOMException. If this’s send() invoked is true, then throw an "InvalidStateError" DOMException. Normalize value. If name is not a header name or value is not a header value, then throw a "SyntaxError" DOMException. An empty byte sequence represents an empty header value. If (name, value) is a forbidden request-header, then return. Combine (name, value) in this’s author request headers. Some simple code demonstrating what happens when setting the same header twice: // The following script: var client = new XMLHttpRequest(); client.open('GET', 'demo.cgi'); client.setRequestHeader('X-Test', 'one'); client.setRequestHeader('X-Test', 'two'); client.send(); // …results in the following header being sent: // X-Test: one, two 3.5.3. The timeout getter and setter client . timeout Can be set to a time in milliseconds. When set to a non-zero value will cause fetching to terminate after the given time has passed. When the time has passed, the request has not yet completed, and synchronous is false, a timeout event will then be dispatched, or a "TimeoutError" DOMException will be thrown otherwise (for the send() method). When set: throws an "InvalidAccessError" DOMException if synchronous is true and the current global object is a Window object. The timeout getter steps are to return this’s timeout. The timeout setter steps are: If the current global object is a Window object and this’s synchronous is true, then throw an "InvalidAccessError" DOMException. Set this’s timeout to the given value. This implies that the timeout attribute can be set while fetching is in progress. If that occurs it will still be measured relative to the start of fetching. 3.5.4. The withCredentials getter and setter client . withCredentials True when credentials are to be included in a cross-origin request. False when they are to be excluded in a cross-origin request and when cookies are to be ignored in its response. Initially false. When set: throws an "InvalidStateError" DOMException if state is not unsent or opened, or if send() invoked is true. The withCredentials getter steps are to return this’s cross-origin credentials. The withCredentials setter steps are: If this’s state is not unsent or opened, then throw an "InvalidStateError" DOMException. If this’s send() invoked is true, then throw an "InvalidStateError" DOMException. Set this’s cross-origin credentials to the given value. 3.5.5. The upload getter client . upload Returns the associated XMLHttpRequestUpload object. It can be used to gather transmission information when data is transferred to a server. The upload getter steps are to return this’s upload object. 3.5.6. The send() method client . send([body = null]) Initiates the request. The body argument provides the request body, if any, and is ignored if the request method is GET or HEAD. Throws an "InvalidStateError" DOMException if either state is not opened or send() invoked is true. The send(body) method steps are: If this’s state is not opened, then throw an "InvalidStateError" DOMException. If this’s send() invoked is true, then throw an "InvalidStateError" DOMException. If this’s request method is `GET` or `HEAD`, then set body to null. If body is not null: Let extractedContentType be null. If body is a Document, then set this’s request body to the result of running the fragment serializing algorithm steps given body and false, converted, and UTF-8 encoded. Otherwise: Let bodyWithType be the result of safely extracting body. Set this’s request body to bodyWithType’s body. Set extractedContentType to bodyWithType’s type. Let originalAuthorContentType be the result of getting `Content-Type` from this’s author request headers. If originalAuthorContentType is non-null: If body is a Document object, a URLSearchParams object, or a string: Let contentTypeRecord be the result of parsing originalAuthorContentType. If contentTypeRecord is not failure, contentTypeRecord’s parameters["charset"] exists, and parameters["charset"] is not an ASCII case-insensitive match for "UTF-8": Set contentTypeRecord’s parameters["charset"] to "UTF-8". Let newContentTypeSerialized be the result of serializing contentTypeRecord. Set (`Content-Type`, newContentTypeSerialized) in this’s author request headers. Otherwise: If body is an HTML document, then set (`Content-Type`, `text/html;charset=UTF-8`) in this’s author request headers. Otherwise, if body is an XML document, set (`Content-Type`, `application/xml;charset=UTF-8`) in this’s author request headers. Otherwise, if extractedContentType is not null, set (`Content-Type`, extractedContentType) in this’s author request headers. If one or more event listeners are registered on this’s upload object, then set this’s upload listener to true. Let req be a new request, initialized as follows: method This’s request method. URL This’s request URL. header list This’s author request headers. unsafe-request flag Set. body This’s request body. client This’s relevant settings object. mode "cors". use-CORS-preflight flag Set if this’s upload listener is true. credentials mode If this’s cross-origin credentials is true, then "include"; otherwise "same-origin". use-URL-credentials flag Set if this’s request URL includes credentials. initiator type "xmlhttprequest". Set this’s upload complete to false. Set this’s timed out to false. If req’s body is null, then set this’s upload complete to true. Set this’s send() invoked to true. If this’s synchronous is false: Fire a progress event named loadstart at this with 0 and 0. Let requestBodyTransmitted be 0. Let requestBodyLength be req’s body’s length, if req’s body is non-null; otherwise 0. Assert: requestBodyLength is an integer. If this’s upload complete is false and this’s upload listener is true, then fire a progress event named loadstart at this’s upload object with requestBodyTransmitted and requestBodyLength. If this’s state is not opened or this’s send() invoked is false, then return. Let processRequestBodyChunkLength, given a bytesLength, be these steps: Increase requestBodyTransmitted by bytesLength. If not roughly 50ms have passed since these steps were last invoked, then return. If this’s upload listener is true, then fire a progress event named progress at this’s upload object with requestBodyTransmitted and requestBodyLength. These steps are only invoked when new bytes are transmitted. Let processRequestEndOfBody be these steps: Set this’s upload complete to true. If this’s upload listener is false, then return. Fire a progress event named progress at this’s upload object with requestBodyTransmitted and requestBodyLength. Fire a progress event named load at this’s upload object with requestBodyTransmitted and requestBodyLength. Fire a progress event named loadend at this’s upload object with requestBodyTransmitted and requestBodyLength. Let processResponse, given a response, be these steps: Set this’s response to response. Handle errors for this. If this’s response is a network error, then return. Set this’s state to headers received. Fire an event named readystatechange at this. If this’s state is not headers received, then return. If this’s response’s body is null, then run handle response end-of-body for this and return. Let length be the result of extracting a length from this’s response’s header list. If length is not an integer, then set it to 0. Let processBodyChunk given bytes be these steps: Append bytes to this’s received bytes. If not roughly 50ms have passed since these steps were last invoked, then return. If this’s state is headers received, then set this’s state to loading. Fire an event named readystatechange at this. Web compatibility is the reason readystatechange fires more often than this’s state changes. Fire a progress event named progress at this with this’s received bytes’s length and length. Let processEndOfBody be this step: run handle response end-of-body for this. Let processBodyError be these steps: Set this’s response to a network error. Run handle errors for this. Incrementally read this’s response’s body, given processBodyChunk, processEndOfBody, processBodyError, and this’s relevant global object. Set this’s fetch controller to the result of fetching req with processRequestBodyChunkLength set to processRequestBodyChunkLength, processRequestEndOfBody set to processRequestEndOfBody, and processResponse set to processResponse. Let now be the present time. Run these steps in parallel: Wait until either req’s done flag is set or this’s timeout is not 0 and this’s timeout milliseconds have passed since now. If req’s done flag is unset, then set this’s timed out to true and terminate this’s fetch controller. Otherwise, if this’s synchronous is true: Let processedResponse be false. Let processResponseConsumeBody, given a response and nullOrFailureOrBytes, be these steps: If nullOrFailureOrBytes is not failure, then set this’s response to response. If nullOrFailureOrBytes is a byte sequence, then append nullOrFailureOrBytes to this’s received bytes. Set processedResponse to true. Set this’s fetch controller to the result of fetching req with processResponseConsumeBody set to processResponseConsumeBody and useParallelQueue set to true. Let now be the present time. Pause until either processedResponse is true or this’s timeout is not 0 and this’s timeout milliseconds have passed since now. If processedResponse is false, then set this’s timed out to true and terminate this’s fetch controller. Report timing for this’s fetch controller given the current global object. Run handle response end-of-body for this. To handle response end-of-body for an XMLHttpRequest object xhr, run these steps: Handle errors for xhr. If xhr’s response is a network error, then return. Let transmitted be xhr’s received bytes’s length. Let length be the result of extracting a length from this’s response’s header list. If length is not an integer, then set it to 0. If xhr’s synchronous is false, then fire a progress event named progress at xhr with transmitted and length. Set xhr’s state to done. Set xhr’s send() invoked to false. Fire an event named readystatechange at xhr. Fire a progress event named load at xhr with transmitted and length. Fire a progress event named loadend at xhr with transmitted and length. To handle errors for an XMLHttpRequest object xhr, run these steps: If xhr’s send() invoked is false, then return. If xhr’s timed out is true, then run the request error steps for xhr, timeout, and "TimeoutError" DOMException. Otherwise, if xhr’s response’s aborted flag is set, run the request error steps for xhr, abort, and "AbortError" DOMException. Otherwise, if xhr’s response is a network error, then run the request error steps for xhr, error, and "NetworkError" DOMException. The request error steps for an XMLHttpRequest object xhr, event, and optionally exception are: Set xhr’s state to done. Set xhr’s send() invoked to false. Set xhr’s response to a network error. If xhr’s synchronous is true, then throw exception. Fire an event named readystatechange at xhr. At this point it is clear that xhr’s synchronous is false. If xhr’s upload complete is false: Set xhr’s upload complete to true. If xhr’s upload listener is true: Fire a progress event named event at xhr’s upload object with 0 and 0. Fire a progress event named loadend at xhr’s upload object with 0 and 0. Fire a progress event named event at xhr with 0 and 0. Fire a progress event named loadend at xhr with 0 and 0. 3.5.7. The abort() method client . abort() Cancels any network activity. The abort() method steps are: Abort this’s fetch controller. If this’s state is opened with this’s send() invoked being true, headers received, or loading, then run the request error steps for this and abort. If this’s state is done, then set this’s state to unsent and this’s response to a network error. No readystatechange event is dispatched. 3.6. Response 3.6.1. The responseURL getter The responseURL getter steps are to return the empty string if this’s response’s URL is null; otherwise its serialization with the exclude fragment flag set. 3.6.2. The status getter The status getter steps are to return this’s response’s status. 3.6.3. The statusText getter The statusText getter steps are to return this’s response’s status message. 3.6.4. The getResponseHeader() method The getResponseHeader(name) method steps are to return the result of getting name from this’s response’s header list. The Fetch Standard filters this’s response’s header list. [FETCH] For the following script: var client = new XMLHttpRequest(); client.open("GET", "unicorns-are-awesome.txt", true); client.send(); client.onreadystatechange = function() { if(this.readyState == this.HEADERS_RECEIVED) { print(client.getResponseHeader("Content-Type")); } } The print() function will get to process something like: text/plain; charset=UTF-8 3.6.5. The getAllResponseHeaders() method A byte sequence a is legacy-uppercased-byte less than a byte sequence b if the following steps return true: Let A be a, byte-uppercased. Let B be b, byte-uppercased. Return A is byte less than B. The getAllResponseHeaders() method steps are: Let output be an empty byte sequence. Let initialHeaders be the result of running sort and combine with this’s response’s header list. Let headers be the result of sorting initialHeaders in ascending order, with a being less than b if a’s name is legacy-uppercased-byte less than b’s name. Unfortunately, this is needed for compatibility with deployed content. For each header in headers, append header’s name, followed by a 0x3A 0x20 byte pair, followed by header’s value, followed by a 0x0D 0x0A byte pair, to output. Return output. The Fetch Standard filters this’s response’s header list. [FETCH] For the following script: var client = new XMLHttpRequest(); client.open("GET", "narwhals-too.txt", true); client.send(); client.onreadystatechange = function() { if(this.readyState == this.HEADERS_RECEIVED) { print(this.getAllResponseHeaders()); } } The print() function will get to process something like: connection: Keep-Alive content-type: text/plain; charset=utf-8 date: Sun, 24 Oct 2004 04:58:38 GMT keep-alive: timeout=15, max=99 server: Apache/1.3.31 (Unix) transfer-encoding: chunked 3.6.6. Response body To get a response MIME type for an XMLHttpRequest object xhr, run these steps: Let mimeType be the result of extracting a MIME type from xhr’s response’s header list. If mimeType is failure, then set mimeType to text/xml. Return mimeType. To get a final MIME type for an XMLHttpRequest object xhr, run these steps: If xhr’s override MIME type is null, return the result of get a response MIME type for xhr. Return xhr’s override MIME type. To get a final encoding for an XMLHttpRequest object xhr, run these steps: Let label be null. Let responseMIME be the result of get a response MIME type for xhr. If responseMIME’s parameters["charset"] exists, then set label to it. If xhr’s override MIME type’s parameters["charset"] exists, then set label to it. If label is null, then return null. Let encoding be the result of getting an encoding from label. If encoding is failure, then return null. Return encoding. The above steps intentionally do not use the get a final MIME type as it would not be web compatible. To set a document response for an XMLHttpRequest object xhr, run these steps: If xhr’s response’s body is null, then return. Let finalMIME be the result of get a final MIME type for xhr. If finalMIME is not an HTML MIME type or an XML MIME type, then return. If xhr’s response type is the empty string and finalMIME is an HTML MIME type, then return. This is restricted to xhr’s response type being "document" in order to prevent breaking legacy content. If finalMIME is an HTML MIME type: Let charset be the result of get a final encoding for xhr. If charset is null, prescan the first 1024 bytes of xhr’s received bytes and if that does not terminate unsuccessfully then let charset be the return value. If charset is null, then set charset to UTF-8. Let document be a document that represents the result parsing xhr’s received bytes following the rules set forth in the HTML Standard for an HTML parser with scripting disabled and a known definite encoding charset. [HTML] Flag document as an HTML document. Otherwise, let document be a document that represents the result of running the XML parser with XML scripting support disabled on xhr’s received bytes. If that fails (unsupported character encoding, namespace well-formedness error, etc.), then return null. [HTML] Resources referenced will not be loaded and no associated XSLT will be applied. If charset is null, then set charset to UTF-8. Set document’s encoding to charset. Set document’s content type to finalMIME. Set document’s URL to xhr’s response’s URL. Set document’s origin to xhr’s relevant settings object’s origin. Set xhr’s response object to document. To get a text response for an XMLHttpRequest object xhr, run these steps: If xhr’s response’s body is null, then return the empty string. Let charset be the result of get a final encoding for xhr. If xhr’s response type is the empty string, charset is null, and the result of get a final MIME type for xhr is an XML MIME type, then use the rules set forth in the XML specifications to determine the encoding. Let charset be the determined encoding. [XML] [XML-NAMES] This is restricted to xhr’s response type being the empty string to keep the non-legacy response type value "text" simple. If charset is null, then set charset to UTF-8. Return the result of running decode on xhr’s received bytes using fallback encoding charset. Authors are strongly encouraged to always encode their resources using UTF-8. 3.6.7. The overrideMimeType() method client . overrideMimeType(mime) Acts as if the `Content-Type` header value for a response is mime. (It does not change the header.) Throws an "InvalidStateError" DOMException if state is loading or done. The overrideMimeType(mime) method steps are: If this’s state is loading or done, then throw an "InvalidStateError" DOMException. Set this’s override MIME type to the result of parsing mime. If this’s override MIME type is failure, then set this’s override MIME type to application/octet-stream. 3.6.8. The responseType getter and setter client . responseType [ = value ] Returns the response type. Can be set to change the response type. Values are: the empty string (default), "arraybuffer", "blob", "document", "json", and "text". When set: setting to "document" is ignored if the current global object is not a Window object. When set: throws an "InvalidStateError" DOMException if state is loading or done. When set: throws an "InvalidAccessError" DOMException if synchronous is true and the current global object is a Window object. The responseType getter steps are to return this’s response type. The responseType setter steps are: If the current global object is not a Window object and the given value is "document", then return. If this’s state is loading or done, then throw an "InvalidStateError" DOMException. If the current global object is a Window object and this’s synchronous is true, then throw an "InvalidAccessError" DOMException. Set this’s response type to the given value. 3.6.9. The response getter client . response Returns the response body. The response getter steps are: If this’s response type is the empty string or "text": If this’s state is not loading or done, then return the empty string. Return the result of getting a text response for this. If this’s state is not done, then return null. If this’s response object is failure, then return null. If this’s response object is non-null, then return it. If this’s response type is "arraybuffer", then set this’s response object to a new ArrayBuffer object representing this’s received bytes. If this throws an exception, then set this’s response object to failure and return null. Allocating an ArrayBuffer object is not guaranteed to succeed. [ECMASCRIPT] Otherwise, if this’s response type is "blob", set this’s response object to a new Blob object representing this’s received bytes with type set to the result of get a final MIME type for this. Otherwise, if this’s response type is "document", set a document response for this. Otherwise: Assert: this’s response type is "json". If this’s response’s body is null, then return null. Let jsonObject be the result of running parse JSON from bytes on this’s received bytes. If that threw an exception, then return null. Set this’s response object to jsonObject. Return this’s response object. 3.6.10. The responseText getter client . responseText Returns response as text. Throws an "InvalidStateError" DOMException if responseType is not the empty string or "text". The responseText getter steps are: If this’s response type is not the empty string or "text", then throw an "InvalidStateError" DOMException. If this’s state is not loading or done, then return the empty string. Return the result of getting a text response for this. 3.6.11. The responseXML getter client . responseXML Returns the response as document. Throws an "InvalidStateError" DOMException if responseType is not the empty string or "document". The responseXML getter steps are: If this’s response type is not the empty string or "document", then throw an "InvalidStateError" DOMException. If this’s state is not done, then return null. Assert: this’s response object is not failure. If this’s response object is non-null, then return it. Set a document response for this. Return this’s response object. 3.7. Events summary This section is non-normative. The following events are dispatched on XMLHttpRequest or XMLHttpRequestUpload objects: Event name Interface Dispatched when… readystatechange Event The readyState attribute changes value, except when it changes to UNSENT. loadstart ProgressEvent The fetch initiates. progress ProgressEvent Transmitting data. abort ProgressEvent When the fetch has been aborted. For instance, by invoking the abort() method. error ProgressEvent The fetch failed. load ProgressEvent The fetch succeeded. timeout ProgressEvent The author specified timeout has passed before the fetch completed. loadend ProgressEvent The fetch completed (success or failure). 4. Interface FormData typedef (File or USVString) FormDataEntryValue; [Exposed=(Window,Worker)] interface FormData { constructor(optional HTMLFormElement form, optional HTMLElement? submitter = null); undefined append(USVString name, USVString value); undefined append(USVString name, Blob blobValue, optional USVString filename); undefined delete(USVString name); FormDataEntryValue? get(USVString name); sequence