5

Can I automatically alter/remove/add specific HTTP headers according to criteria such as URL (by regex) and maybe referrer?

EDIT: Alternatively, what local proxy would do this, preferably for free?

I'm primarily interested in Chrome, but this question relates to all browsers. If nothing is available for Chrome I might resort to whatever browser does have a solution.

I have a few sites that I always keep open. I decided to consolidate them into one page by containing each one in an iframe. At least one of the pages I use doesn't like this idea; it apparently sends X-FRAME-OPTIONS: SAMEORIGIN to protect me from the black hats. I appreciate the gesture, but I'd like to use the data they send me in the way that makes the most sense to me.

So I decided that the simplest way around this is to detect that my page is the referrer (I could put a dummy variable in the iframe's query string if necessary) and strip X-FRAME-OPTIONS from the response so Chrome doesn't realize the page wanted to disable cross-domain embeds.

I tried searching the Chrome Web Store and Google but couldn't find anything. Surely there's something? I know there's Live HTTP Headers in Firefox and similar in Chrome, but that requires that I edit the headers manually. This task should be automated.

Improve this question
4
  • 2
    Does it have to be a browser extension? Would a local proxy be acceptable? There's a lot of local proxies that allow you to modify HTTP headers and even the content.
    – Bob
    Nov 16, 2012 at 8:35
  • Bob, I had never heard of such a thing. That would be perfect... I've edited the question.
    – Grault
    Nov 16, 2012 at 18:04
  • [This appears to be a way to do it][1], using Apache as a proxy server. [1]: stackoverflow.com/questions/154441/…
    – djangofan
    Nov 16, 2012 at 18:13
  • 1
    as far as proxies go, I think Fiddler should work, if you're running Windows somewhere.
    – Rich Homolka
    Nov 16, 2012 at 18:51

4 Answers 4

Reset to default
2

As I mentioned in a comment, there are many local proxies that can accomplish this. A common one is Squid, a caching proxy. Polipo is another one, and apparently lighter than Squid. There are many other options, such as those listed here.

Squid

Their ContentAdaptation wiki article lists different methods of modifying the stream. The simplest is in the squid.conf configuration file, with request_header_replace and reply_header_replace. If you want to remove headers entirely, you can use request_header_access and reply_header_access.

In your case, you probably want reply_header_access X-Frame-Options deny all, which should remove the header. You could also modify it to reply with anything other than SAMEORIGIN or DENY, which will allow it as per this SO answer (but this is a special case, and apparently undocumented, so better to just remove it).

Remember, you need to run Squid with the argument/option --enable-http-violations to use these options.

You may also wish to disable the caching aspect of Squid.

Polipo

The censoredHeaders variable accepts a list of HTTP headers to block. You can add From, X-Frame-Options to this list. See here for instructions on configuring Polipo.

There is no clear-cut way to disable caching in Polipo - apparently it doesn't use a buffer in memory, instead always saving to disk. However, you can force it to always request a new page by setting the maxExpiresAge, maxAge and maxNoModifiedAge variables to 0 (maybe 1, if 0 does not work). See here.

Improve this answer
2
  • Squid is also included with custom router firmware such as DD-WRT and Tomato, and you can do fun things with it.
    – Bob
    Nov 17, 2012 at 1:15
  • Thanks... It looks like I have a lot of personal research & devel-, err, configuration to do.
    – Grault
    Nov 17, 2012 at 4:47
3

I know you prefer Chrome, but its architecture makes it hard for stuff like this, because they try to isolate things a lot.

A quickie Firefox plugin search found modifyheaders.

As far as proxies go, maybe Fiddler would work.

I haven't tested either of these personally, but both seem like they may do what you want.

Improve this answer
1
  • I actually was using Firefox not too long ago, but I transitioned to Chrome. Now both are on my task bar. (Although I forgot to mention it in my edit, and it wasn't relevant before then, I am on Windows.) Thanks!
    – Grault
    Nov 17, 2012 at 4:51
1

For Chrome, there exists: Ignore X-Frame headers. Working nicely for me!

I'm using https://addons.mozilla.org/en-US/firefox/addon/modify-headers/ on Firefox when I need the same thing - requires some minimal configuration.

Improve this answer
0

What about Modify headers for Chrome https://chrome.google.com/webstore/detail/modify-headers-for-google/innpjfdalfhpcoinfnehdnbkglpmogdi

It's good for example for adding debug headers for users of Akamai's caching platform

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .