I am unable to add a recovery phone number to my Zoho account because of an invalid header key set by the web application's JavaScript. In zohoaccounts.js, there is the following (pretty-printed) function:
- function getPlainResponse(action, params) {
- 0 === params.indexOf("&") && (params = params.substring(1));
- var objHTTP;
- return objHTTP = xhr(),
- objHTTP.open("POST", action, !1),
- objHTTP.setRequestHeader("Content-Type", "application/x-www-form-urlencoded;charset=UTF-8"),
- isEmpty(params) && (params = "__d=e"),
- objHTTP.setRequestHeader("Content-length", params.length),
- objHTTP.send(params),
- objHTTP.responseText
- }
On line 8 of this snippet, the content length header key is set as "Content-length", which is rejected by modern browsers. The header key should be "Content-Length".