Don't know why i am getting unsafe header error in console. Everything is working fine but i am wondering what is the error here. Below is the code:

function getFieldOptions (objName, ctrlFieldName) {
        // Isolate the Describe info for the relevant fields
        sforce.connection.sessionId = '{!$Api.Session_ID}'; 

        var objDesc = sforce.connection.describeSObject(objName);
        var ctrlFieldDesc, depFieldDesc;
        var dependentOptions =[];
        for (var i=0; i<objDesc.fields.length; i++) {
            var f = objDesc.fields[i];
            if (f.name == ctrlFieldName) {
                for (var i=0; i<f.picklistValues.length; i++) {
        return dependentOptions;
var choices = getFieldOptions('Task','Status');

This is the error i am getting in console.enter image description here

Can anyone please help me with this. Thanks!!


2 Answers 2


The XMLHttpRequest#setRequestHeader specifically states that User-Agent must not be set by a client script, and any attempt to set that header should be ignored. The connection.js script tries to set "User-Agent" to "SFAJAX 1.0", and Chrome rejects this setting and outputs an error (as should all modern browsers). It does not cause the script to stop running; this error is completely harmless, and you can ignore it.

Historically, this was written in so that the Salesforce servers could identify that this was a salesforce AJAX Toolkit API call. This toolkit predates the requirement that some headers be rejected if a script tries to set them, and most, if not all, browsers happily allowed you to spoof the User-Agent string. These days, the header is effectively ignored, but it's still in the source code. In fact, you can see there's still even support for Msxml2.XMLHTTP and Microsoft.XMLHTTP, despite the fact that the browsers that use those objects are no longer in the Supported Browser list.

If you're having a problem with the AJAX Toolkit not doing what you expect, this error is not the cause of your problems.

  • I am developing a salesforce app and curious to know before giving it to checkmarx if it fails due to this error. Thanks for your reply!! Sep 26, 2016 at 16:15
  • @HeadInCloud I don't think checkmarx checks for benign script errors. It's primary focus is security problems, major optimizations, and unit tests.
    – sfdcfox
    Sep 26, 2016 at 16:17

The spec changed in August 2015. It is now permitted to set User-Agent in setRequestHeader but mozilla are the only organisation to actually implement this so far. The other browsers need to catch up!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .