Yes, GM.xhr does need to be initiated from the background script, which I was doing; and using the plain browser xhr did fix the problem. I think I originally used GM_xhr as the request was cross-domain (http and https versions of the same site), but the website later switched to using https for everything.
I think it would still be helpful if GM.xhr could use credentials from the content script for cross-site requests. Having done some more reading, I see that the standard XHR <https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest> and Fetch <https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch> APIs both have options for sending credentials with requests. On Sunday, 19 November 2017 00:56:02 UTC, [email protected] wrote: > > Hi James, > > I think GM.xhr needs to be initiated from the GM background script, rather > than content script. Anthony, can confirm I'm sure. > > So just a quick suggestion, but if you are fetching from the same website, > then you don't need the privileges of cross-domain requests that GM.xhr > provides. So just quickly test your script using the browser xhr in place > of GM.xhr. > > If you give this a try, let us know if it solves the problem? > > Damo. > > On Sunday, November 19, 2017 at 12:29:12 AM UTC+10, James Inge wrote: >> >> One of my scripts used GM_xmlhttpRequest() to fetch a new web page from >> the website it is running on. It's a same-domain request, but the website >> requires the user to be logged in. Before GM4, the request worked fine, >> and returned a page containing the logged-in user's data. In GM4, >> GM.xmlHttpRequest() fetches a page that would be shown to a user who >> wasn't logged in. >> >> I assume the problem is that Greasemonkey no longer sends the same >> cookies with the request that would be sent with a request from the content >> scope. Is this something that can be fixed, or do I need to find a >> workaround? >> >> -- You received this message because you are subscribed to the Google Groups "greasemonkey-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/greasemonkey-users. For more options, visit https://groups.google.com/d/optout.
