Currently, there's no way to modify requests sent by the Spine Web client for JavaScript to the backend. The common use case is the necessity to attach security headers to all HTTP requests to the backend. To do so in Pure Photos, we initialize the client instance and then replace its internal HttpClient with our custom client that does the same things, but attaches some headers to the requests.

Another thing that is currently not configurable is that the standard HttpClient sends requests in the CORS mode. It may be OK for the most applications but should not be mandatory. Some applications may have the same origin for their frontend/backend and use regular requests in non-CORS mode.