How can I override the Origin header in Chrome when connecting to a WebSocket?

Question

I am trying to connect to an external web socket server, which is not run by myself. I would like to connect to it from a localhost javascript file, therefore the origin header has null value.

I understand that this is a measure against cross-site forgery. However, since I am on localhost, I should be able to fake this, by getting Chrome to send a custom Origin header.

Is it possible? (if I need an extension, that is fine)

If not, what is my best option to achieve the above? Thank you.

Answer 1

As far as I know this will not be possible, it would break the security guards against CSRF in Chrome.

If you were able to do that the whole concept of XHR would fall apart.

Here is an Extension you can use to manipulate header on the fly, but so far I have not been able to get it to manipulate socket headers.

Look here if you want to read more about this.

But this doesn't stop you from implementing your own client (in place of chrome) where you can literally send whatever headers you want, not sure if this helps you, sorry.