title: The HTTP request must contain a user-specific secret - Error in fortify
body: <p>I have below code in my applicaton.</p>
  
  <pre><code>makeAjaxRequest: function(url, data){
      var xhr = new XMLHttpRequest();
      xhr.open('POST', url, true);
      xhr.onload = function () {
          var response = Ext.JSON.decode(xhr.responseText);
          if (response) {
              Ext.Msg.alert('Alert', response.message);
              Ext.getBody().unmask();
          }
      };
      Ext.getBody().mask('Loading...');
      xhr.send(data);
  }
  </code></pre>
  
  <p>Fortify is showing this error for this line</p>
  
  <p>Error  - "The http request at * line * must contain a user-specific secret in order to prevent an attacker from making unauthorized requests"</p>
  
  <pre><code>xhr.open('POST', url, true);
  </code></pre>
  
  <p>How do i resolve this fortify issue?</p>
  
  <p>Is it something Fortify is highlighting because it doesn't have full context of the application.</p>
  
  <p>In my application i have SSO setup which is passing a user specific secret with every request. But fortify may not be aware of it and ends up flagging this as an issue.</p>
  
  <p>Kindly advice on what is best way to resolve this issue.</p>
  
  <p>Thanks.</p>