Fix /whoami: remove fetch() for now

[vchess.git] / client / src / utils / ajax.js

diff --git a/client/src/utils/ajax.js b/client/src/utils/ajax.js
index 83b045c..eb30330 100644 (file)
--- a/client/src/utils/ajax.js
+++ b/client/src/utils/ajax.js
@@ -2,6 +2,7 @@ import params from "../parameters"; //for server URL
 
 // TODO: replace by fetch API ?
 // https://www.sitepoint.com/xmlhttprequest-vs-the-fetch-api-whats-best-for-ajax-in-2019/
+// Problem: fetch() does not set req.xhr... see access/ajax() security especially for /whoami
 
 // From JSON (encoded string values!) to "arg1=...&arg2=..."
 function toQueryString(data)