x_requested_with.bro

##! Add support for X-Requested-With                                                                                                                                                                                                                                           
@load base/protocols/http
@load base/frameworks/software
@load policy/protocols/http/software-browser-plugins

module HTTP;

export {
        redef record HTTP::Info += {
                ## X-REQUESTED_WITH value, if set                                                                                                                                                                                                                               
                x_requested_with: string &log &optional;
                ## T if this was requested with XMLHttpRequest                                                                                                                                                                                                                  
                is_ajax: bool &log &optional;
        };

        # If this matches the XHR value, pass it to the software framework                                                                                                                                                                                                      
        const xhr_browser_plugins = /^ShockwaveFlash/ &redef;
}

event http_header(c: connection, is_orig: bool, name: string, value: string)
        {
        if ( ! is_orig || ! c?$http )
                return;

        if ( name == "X-REQUESTED-WITH" )
                {
                c$http$x_requested_with = value;
                c$http$is_ajax = value == "XMLHttpRequest";
                if ( xhr_browser_plugins in value )
                        Software::found(c$id, [$unparsed_version=value, $host=c$id$orig_h, $software_type=BROWSER_PLUGIN]);
                }
        }