I am using Dropzone to pimp the file upload of an existing form - the whole thing must continue to behave like if it would be an ordinary HTML form. Dropzone is flexible, I intercept clicks on my button(s) and call Dropzone.processQueue() from there which internally does an XMLHttpRequest with the form data as the payload - works as intended, submitting the form just like it should.
Edit, as my description seemd to be confusing: I am basically following this HOWTO https://docs.dropzone.dev/configuration/tutorials/combine-form-data-with-files and the problem/question results from (and only consists of) the line redirect user or notify of success.
However: The application returns a 303 redirect on the POST request followed by an HTML page, and this page should be presented to the user. I can see to ways to proceed:
a) catch the result of the POST request, extract the location header and redirect the browser. I'd strongly prefer this, but unfortunately it does not seem possible: Prevent redirection of Xmlhttprequest
b) let XMLHttpRequest (nolens volens) follow the redirect, catch the result of the GET request and display it:
let newHTML = document.open('text/html', 'replace');
newHTML.write(htmlResponse);
newHTML.close();
This is not beautiful, but it works - as far as HTML is concerned. However I get several errors like
Refused to execute inline script because it violates the following Content Security Policy directive for obvious reasons (and scripts won't work). Allowing unsafe-inline is not an option here; is there any way to let the browser behave as if a string were the result of a request (which in fact it is, but nobody knows...)?
Is there any clean solution to this?
