Cookies not present after using XMLHttpRequest

Update: It looks like after receiving a 403 response, the xmlhttprequest just hangs there, and so the document.location code is never executed, any ideas on how to get around this?

I'm trying to make a bookmarklet to download videos off of YouTube, but I've come across a little problem.

To detect the highest quality video available, I use a sort of brute force method, in which I make requests using the XMLHttpRequest object until a 404 isn't returned (I can't do it until a 200 ok is returned because YouTube redirects to a different server if the video is available, and the cross-domain policy won't allow me to access any of that data).

Once a working URL is found, I simply set window.location to the URL and the download should start, right? Wrong. A request is made, but for reasons unknown to me, the cookies are stripped and YouTube returns a 403 access denied. This does not happen if the XML requests aren't made before it, i.e. if I just set window.location to the URL, everything works fine, it's when I do the XMLHttpRequest that the cookies aren't sent.

It's hard to explain so here's the script:

var formats = ["37", "22", "35", "34", "18", ""];
var url = "/get_video?video_id=" + yt.getConfig('SWF_ARGS')['video_id'] + "&t=" + (unescape(yt.getConfig('SWF_ARGS')['t'])) + "&fmt=";
for (var i = 0; i < formats.length; i++) {
    xmlhttp = new XMLHttpRequest;
 xmlhttp.open("HEAD", url + formats[i], false);
    xmlhttp.send(null);
    if (xmlhttp.status != 404) {
        document.location = url + formats[i];
        break
    }
}

That script does not send the cookies after setting the document.location and thus does not work. However, simply doing this:

document.location = "/get_video?video_id=" + yt.getConfig('SWF_ARGS')['video_id'] + "&t=" + (unescape(yt.getConfig('SWF_ARGS')['t']))

DOES send the cookies along with the request, and does work. The only downside i开发者_如何学编程s I can't automatically detect the highest quality, I just have to try every "fmt" parameter manually until I get it right.

So my question is: why is the XMLHttpRequest object removing cookies from subsequent requests?

This is the first time I've ever done anything in JS by the way, so please, go easy on me. ;)

Update: It looks like after receiving a 403 response, the xmlhttprequest just hangs there, and so the document.location code is never executed, any ideas on how to get around this?

It seems unlikely that it's the AJAX request removing the cookie (which would be a browser bug) and more likely that YouTube is revoking the session (which is identified by the cookie) by removing the cookie. I notice the two requests are different - does this work

document.location = "/get_video?video_id=" + yt.getConfig('SWF_ARGS')['video_id'] + "&t=" + (unescape(yt.getConfig('SWF_ARGS')['t'])) + "&fmt=37"

Also try only testing for two different formats - YouTube might think you're trying to brute force, or just not allow attempted API mashups by revoking cookies from request over XMLhttp...

Drew, It is perhaps late and perhaps you know this already! But if you have access to the server's private key then you can decrypt the traffic quite easily in Wireshark. http://support.citrix.com/article/CTX116557/