In response to what you're trying solve given the Apache snippet rather than the actual question:
You can't enforce Client Certs after SSL handshake has taken place and certainly not after inspection of the HTTP headers, so your idea is not possible.
Further more, SSLVerifyClient optional
is not supported by any mainstream browser and leads to strange SSL connect errors.
The only way to do this on the server side is to create a separate vhost dedicated to XHR requests.
However, on the client side have you tried xhr.withCredentials = true
. From memory, this sends the client certs and any other auth data with the XHR request.