Bdtjtk

I have a Website and a python flask RESTFUL API. When testing the API with Postman it works just fine, but the same request using XMLHttprequest in js gives me a 400 BAD Request code. I looked at the headers send and replicated the XMLHttprequest headers in Postman, to get a 400 BAD REQUEST Code. If i remove the Content-Length header from the request, it works fine. My Postman code (HTML, without content-length):

POST /user/181453766040485888 HTTP/1.1

Host: 127.0.0.1:5000

Content-Type: multipart/form-data; boundary=--- 

-WebKitFormBoundary7MA4YWxkTrZu0gW

Accept: */*

Accept-Encoding: gzip, deflate, br

Accept-Language: en-US,en;q=0.9

Connection: keeep-alive

Host: 127.0.0.1:5000

Origin: http://localhost:52014

Referer: http://localhost:52014/settings.php

User-Agent: Mozilla/5.0 (Windows NT 10.0; 

Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 OPR/57.0.3098.106 (Edition Campaign 76)

cache-control: no-cache

Postman-Token: 5dd34b0b-965c-4d31-83b9-2364b03c0aa2



Content-Disposition: form-data; name="status"



0



Content-Disposition: form-data; name="username"



0



Content-Disposition: form-data; name="token"



0



Content-Disposition: form-data; name="display_names"



1



Content-Disposition: form-data; name="messages"



1



Content-Disposition: form-data; name="roles"



1



Content-Disposition: form-data; name="votes"



1

------WebKitFormBoundary7MA4YWxkTrZu0gW--

My js function (for testing):

function save() {

        var formData = new FormData();

        formData.append("status", 0);

        formData.append("username", 0);

        formData.append("token", 0);

        formData.append("display_names", 0);

        formData.append("messages", 0);

        formData.append("roles", 0);

        formData.append("votes", 0);



        const Http = new XMLHttpRequest();

        const url='http://127.0.0.1:5000/user/181453766040485888';

        Http.open("POST", url);

        Http.onreadystatechange=(e)=>{

            console.log(Http.responseText)

        }

        Http.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

        Http.send(formData);

    }

my API function that handles the request (abstract):

def post(self, id):

    if database.execute(database.SAVE_USER_SETTINGS.format(id, request.form["status"], request.form["username"],

                                                        request.form["token"], request.form["display_names"],

                                                        request.form["messages"], request.form["roles"],

                                                        request.form["votes"])):

        return (id, request.form["status"], request.form["username"],

                    request.form["token"], request.form["display_names"],

                    request.form["messages"], request.form["roles"],

                    request.form["votes"]), 201



    return {}, 500