I am using the HMAC for authentication, but
$.ajax({
type: "POST",
url: baseURL + "/test/hmac",
contentType: "application/json",
dataType: "json",
beforeSend: function (request) {
request.setRequestHeader('authorization', 'AuthHMAC '+client.key +":" + CryptoJS.HmacSHA1(canonical_string, client.secret).toString(CryptoJS.enc.Base64));
request.setRequestHeader('content-md5', md5);
request.setRequestHeader('Dates', date); //Refused to set unsafe header "Date"
},
data: JSON.stringify(data),
success: function (data) {
alert(data.message);
},
error: function (errorMessage) {
if(errorMessage.status == 401)
alert('Access denied');
}
});
however the code gets a error on request.setRequestHeader('Date', date);
that the browser says to me 'Refused to set unsafe header "Date" '
this is problematic since Date header is important for HMAC against replay attack, so as I can't change much on the server , how can I do it on the client side to let it automatically add Date to the header