以前可以通过 Javascript 访问 HTTP 请求

Question

Are the responses/payloads of previously made HTTP requests accessible programmatically via Javascript?

I'd like know, if in the same way hackers can use XSS to access cookies/localStorage stores in the browser, can they access data from previously made HTTP requests (since the browser DevTools has the previous requests listed and visible in the network tab).

Answer 1

They are only accessible if code runs before or during the request that programatically saves the response. For example, one could overwrite window.fetch and save (but pass through) all requests and responses, or do the same for XMLHttpRequest, or save the result of a request normally inside a .then or in an onload handler.

Devtools does have access to prior requests, but devtools has access to many things that can't be done via JavaScript - this is one of them.