Tuesday, 30 May 2017

Surpassing same-origin policy with server requests - NodeJS/Express

I'm trying to achieve a structure described in this article - "Using a Web Proxy" using a NodeJS server with Express. I need to access the html of an embedded iframe which is of course impossible due to same-origin policy. As a workaround, I figured that I could simply request the iframe on my server and then pass it on to the client.

I made an entry point on my server called /getIframe.

When the client requests /getIframe, my server makes a request to the desired location and saves the page as a html document (using fs) which is then sent back to the client. This works fine but all scripts/css included in the html are not being passed as request only gets the html.

So, I downloaded the scripts/css manually and voilĂ , it's working. Here is the code.

app.get('/test', function(req, res, next) {
  request("http://www.iframeurl.com/something", function(error, response, body) {
    fs.writeFileSync('iframe.html', body, 'utf8');
    var html = fs.readFileSync('iframe.html', 'utf8')
    res.send(html);
  });
})

I now have the behaviour I was looking for but the need of manually downloading the script is not ideal.

Is there a way to request a page on a Node server and just pass it on to the client with all the content (scripts, css etc.)?

What I'm looking for is something like

app.get('/getIframe', function(req, res, next) {
  request("http://www.iframeurl.com/something", function(error, response, body) {
    //pass on the requested page in a response with res.send(thePage) or render it with res.render(..)
  });
})



via Percolator

No comments:

Post a Comment