Image Upload not setting appropriate headers in XMLHttpRequest

Hi, I am trying to configure my editor to point to a url to upload images as described here:

images_upload_url: '/images/upload',

I need to pass along a csrf token along with the XMLHttpRequest otherwise the server will deny it. I am manually setting an additional header on any XHR as defined here:

tinymce.util.XHR.on('beforeSend', function (e) {
    e.xhr.setRequestHeader('X-CSRF-TOKEN', window.csrfToken);
});

which works just fine when using the spellchecker plugin. However, when the image upload request is sent via the file browser, the X-CSRF-TOKEN header is missing:

According to the images_upload_handler option, when not set, the default action would be to use a XHR to upload the images. This does not appear to be the case as the X-Requested-With:XMLHttpRequest is also missing from the headers.

[Stetzon]

I have a workaround by using the images_upload_handler option instead of the images_upload_url and modifying the example to manually set the XHR request header:

imagesUploadHandler(blobInfo, success, failure) {
    let xhr = new XMLHttpRequest();
    xhr.open('POST', '/images/upload');
    xhr.setRequestHeader('X-CSRF-TOKEN', window.csrfToken); // manually set header

    xhr.onload = function() {
        if (xhr.status !== 200) {
            failure('HTTP Error: ' + xhr.status);
            return;
        }

        let json = JSON.parse(xhr.responseText);

        if (!json || typeof json.location !== 'string') {
            failure('Invalid JSON: ' + xhr.responseText);
            return;
        }

        success(json.location);
    };

    let formData = new FormData();
    formData.append('file', blobInfo.blob(), blobInfo.filename());

    xhr.send(formData);
}

[sumon4skf]

I have a workaround by using the images_upload_handler option instead of the images_upload_url and modifying the example to manually set the XHR request header:

imagesUploadHandler(blobInfo, success, failure) {
    let xhr = new XMLHttpRequest();
    xhr.open('POST', '/images/upload');
    xhr.setRequestHeader('X-CSRF-TOKEN', window.csrfToken); // manually set header

    xhr.onload = function() {
        if (xhr.status !== 200) {
            failure('HTTP Error: ' + xhr.status);
            return;
        }

        let json = JSON.parse(xhr.responseText);

        if (!json || typeof json.location !== 'string') {
            failure('Invalid JSON: ' + xhr.responseText);
            return;
        }

        success(json.location);
    };

    let formData = new FormData();
    formData.append('file', blobInfo.blob(), blobInfo.filename());

    xhr.send(formData);
}

Works for me, TinyMCE Version: 5.1.5 (2019-12-19)

Thanks,