title: How do I set a default Header for all XMLHTTPRequests
body: <p><strong>Problem description</strong></p>
  
  <p>We are running a Kibana 4.3 service. I do not want to modify the source code.</p>
  
  <p>The objective is add an encrypted token, call it A-Token to every Ajax request that the browser makes to Kibana.</p>
  
  <p><strong>Background</strong></p>
  
  <p>The Kibana service is proxied by nginx.</p>
  
  <p>When a user makes an Ajax request to the Kibana service, the request is intercepted by an nginx http_auth_request proxy and passed to an "auth" service that validates the token. If its missing or invalid, then "auth" returns 201 to http_auth_request and the request to the Kibana service is executed, else it returns a 404 and the request is denied since it was made without a valid token.   </p>
  
  <p>(this scheme is based on the encrypted token pattern often used as a countermeasure for cross-site scripting in session-less situations like the one at hand).</p>
  
  <p>I read the W3 XMLHttpRequest documentation and it seems that setRequestHeader needs to run after open and before send - which implies that this scheme is either impossible in a general case or very JS platform dependent.</p>
  
  <p>A test using the Jquery .ajaxSetup  like this example, confirms that headers cannot be set independently:</p>
  
  <pre><code>$.ajaxSetup({
      beforeSend: function(xhr) {
                  xhr.setRequestHeader(A-Token", 1314159);
                    }
  });
  </code></pre>
  
  <p>Looking for possible solutions which will not require forking Kibana. </p>
  
  <p>Danny</p>