Why Does for…in Miss XMLHttpRequest Properties on iOS 14.5? Uncovering the api‑monitor Bug

Conclusion: The api‑monitor library automatically reports request latency, error information, error codes, and HTTP status codes for monitoring API quality.

Before testing, consider whether the following code can enter a for…in loop:

var origin = {};
Object.defineProperty(origin, 'username', {
  get() { return 'mbj'; },
  set() {},
  configurable: true,
  enumerable: true,
});
var obj = Object.create(origin);
Object.defineProperty(obj, 'username', {
  get: function () { return 'wmy'; },
  set: function () {},
});
console.log('obj', obj);
for (var attr in obj) {
  console.log('attr', attr);
  console.log(`obj.${attr} descriptor`, Object.getOwnPropertyDescriptor(obj, attr));
  console.log(`obj.__proto__.${attr} descriptor`, Object.getOwnPropertyDescriptor(obj.__proto__, attr));
}

Test results show that on iOS 14.5 beta and PC Chrome the loop does **not** execute, while on non‑14.5 iOS versions and Android it does. The core problem is that when an object has a non‑enumerable own property and an enumerable property with the same name on its prototype, the property may be skipped by for…in on some platforms.

Further investigation reveals that api‑monitor replaces window.XMLHttpRequest with its own wrapper. The wrapper defines many properties using Object.defineProperty with enumerable: false and configurable: false. On iOS 14.5 beta, the for…in traversal cannot see properties such as onreadystatechange or responseText, causing the monitoring library to miss responses.

Summary of enumeration behavior:

iOS 14.5 beta and PC Chrome: for…in does not enumerate the property.

Non‑14.5 iOS and Android: for…in does enumerate the property.

Because the wrapper’s prototype properties are enumerable while the instance properties are not, the discrepancy appears only on platforms that treat prototype‑shadowed non‑enumerable properties differently. This demonstrates that relying on for…in to proxy XMLHttpRequest is unreliable across browsers.

The article also includes the implementation details of the api‑monitor interception, which builds on the ajax‑hook library, and shows code snippets for both the wrapper and the original request traversal.