Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

In Chrome Extension, change referrer for ajax requests sent to certain domain?

I've done some research and I now know it's not possible to send a request with a changed referrer in Google Chrome because the browser will overwrite the change, but is there anyway/any permissions in a Google Chrome Extension that would disable this, or make it so that you could send a request to a certain domain with a different referrer?

like image 810
Sam Avatar asked Jun 23 '15 09:06

Sam


People also ask

What is referrer policy strict origin cross origin?

strict-origin-when-cross-origin offers more privacy. With this policy, only the origin is sent in the Referer header of cross-origin requests. This prevents leaks of private data that may be accessible from other parts of the full URL such as the path and query string.

Can Chrome extensions make HTTP requests?

When building a Chrome extension, you can make cross-site XMLHttpRequests via Content Scripts or the Background Page. Content Scripts is JavaScript that can get injected into a webpage and can manipulate the page's DOM.


1 Answers

chrome.webRequest is what you're looking for, specifically thee onBeforeSendHeaders event. It will allow you to change any headers (even unsafe ones) before sending the request, but can only be used in a background script.

You'll need to add webRequest and webRequestBlocking to your permissions list in the manifest.

chrome.webRequest.onBeforeSendHeaders.addEventListener(handle(details), filterObject, extraInfoArray);

Here's an example:

chrome.webRequest.onBeforeSendHeaders.addListener(function(details){
    var newRef = "http://referer.domain/helloworld.example";
    var gotRef = false;
    for(var n in details.requestHeaders){
        gotRef = details.requestHeaders[n].name.toLowerCase()=="referer";
        if(gotRef){
            details.requestHeaders[n].value = newRef;
            break;
        }
    }
    if(!gotRef){
        details.requestHeaders.push({name:"Referer",value:newRef});
    }
    return {requestHeaders:details.requestHeaders};
},{
    urls:["http://target.domain/*"]
},[
    "requestHeaders",
    "blocking",
    "extraHeaders"
]);

The filterObject tells it to only fire the handle for any with the urls matching ones in the list.

The extraInfoArray tells it you want to get requestHeaders, and blocking tells it to pause the request until the handle is finished.

like image 132
WebGL3D Avatar answered Oct 18 '22 08:10

WebGL3D