Clojurians Log v2
Clojure programming
Channels
Apps
web-security 2023-10-30
Martynas Maciulevičius 2023-10-30T12:33:52.644539Z
Is there a good way to "securely" strip CORS and CSP headers without having a controlled backend or MITM backend?
I know that web browsers won't allow to do this and if I'd be having a back-end that would do the request for me then I have to move all the user's cookies to it.
What I want to do is to make requests on behalf of the user (with user's session) and on the user's device but I also want to automate them 🤔
I know that this can very easily be used for an attack but let's say I still want to do it 🤔
Ideally I'd like to just render and iframe and do some document.querySelector and call it a day 🤔
Rupert (Sevva/All Street) 2023-10-30T13:54:27.586199Z
Ideally I’d like to just render and iframe and do some document.querySelector and call it a dayUnless the iframe is pointing to a URL on your domain name - you can’t access it like that.
> Is there a good way to “securely” strip CORS and CSP headers without having a controlled backend or MITM backend?
You can’t do this on the frontend (there are strictly enforced rules in the browser preventing it)- you do need to have a backend. You can write proxy backends like this very easily in clojure (combining https://github.com/ring-clojure/ring to receive a request with https://github.com/dakrone/clj-http to make a request).